CVE-2018-14624
Fixed in a distro release EPSS 2%CVSS 7.5
A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.
Products: fedoraproject 389_directory_server, redhat enterprise_linux_desktop, redhat enterprise_linux_server, redhat enterprise_linux_server_aus, redhat enterprise_linux_server_eus, redhat enterprise_linux_server_tus, redhat enterprise_linux_workstation, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | 389-ds-base | 1.3.7.5-28.amzn2.0.1 |
| Amazon Linux 2 | 389-ds-base-devel | 1.3.7.5-28.amzn2.0.1 |
| Amazon Linux 2 | 389-ds-base-libs | 1.3.7.5-28.amzn2.0.1 |
| Amazon Linux 2 | 389-ds-base-snmp | 1.3.7.5-28.amzn2.0.1 |
| Debian 12 | 389-ds-base | 1.4.0.18-1 |
| Debian 13 | 389-ds-base | 1.4.0.18-1 |
| Debian 8 | 389-ds-base | 1.3.3.5-4+deb8u3 |
| Red Hat Enterprise Linux 7 | 389-ds-base | 0:1.3.7.5-28.el7_5 |
| Red Hat Enterprise Linux 7 | 389-ds-base-debuginfo | 0:1.3.7.5-28.el7_5 |
| Red Hat Enterprise Linux 7 | 389-ds-base-devel | 0:1.3.7.5-28.el7_5 |
| Red Hat Enterprise Linux 7 | 389-ds-base-libs | 0:1.3.7.5-28.el7_5 |
| Red Hat Enterprise Linux 7 | 389-ds-base-snmp | 0:1.3.7.5-28.el7_5 |
| SUSE Linux Enterprise Module for Server Applications 15 | 389-ds | 1.4.0.3-4.7.52 |
| SUSE Linux Enterprise Module for Server Applications 15 SP1 | 389-ds | 1.4.0.3-4.7.52 |
| Ubuntu 26.04 LTS | 389-ds-base | no fix |
| Ubuntu Pro 16.04 LTS | 389-ds-base | no fix |
| Ubuntu Pro 18.04 LTS | 389-ds-base | no fix |
| openSUSE Leap 15.0 | 389-ds | 1.4.0.3-lp150.3.3.1 |
| openSUSE Tumbleweed | 389-ds | 2.0.10~git0.21dd2802c-1.1 |