RHSA-2024:4210 - Security Advisory

Topic

An update for the redhat-ds:11 module is now available for Red Hat Directory Server 11.9 for RHEL 8.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Directory Server is an LDAPv3-compliant directory server. The suite of packages includes the Lightweight Directory Access Protocol (LDAP) server, as well as command-line utilities and Web UI packages for server administration.

Security Fix(es):

• ns-slapd crashing in ldap_mods_free() (CVE-2024-2199) (BZ#2267976)
• Potential denial of service via specially crafted kerberos

AS-REQ request (CVE-2024-3657) (BZ#2274401)

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Directory Server 11.9 x86_64

Fixes

• BZ - 2267976 - CVE-2024-2199 389-ds-base: Malformed userPassword may cause crash at do_modify in slapd/modify.c
• BZ - 2274401 - CVE-2024-3657 389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request

CVEs

• CVE-2024-2199
• CVE-2024-3657

References

• https://access.redhat.com/security/updates/classification/#important