389-ds-base
17 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-9064 | | 389-ds-base: 389-ds-base: unbounded ldap controls count in get_ldapmessage_controls_ext() causes cpu and heap amplification (remote dos) | HIGH 7.5 | 0.8 % | ||
| CVE-2025-2487 | 2.4.0 – 2.4.6 ; 2.5.0 – 2.5.3 ; 2.6.0 – 2.6.1 ; … | 389-ds-base: null pointer dereference leads to denial of service | MEDIUM 4.9 | 0.6 % | ||
| CVE-2024-8445 | 3.1.1 | 389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199) | MEDIUM 5.7 | 0.4 % | ||
| CVE-2024-6237 | < 2.4.5 | 389-ds-base: unauthenticated user can trigger a dos by sending a specific extended search request | MEDIUM 6.5 | 0.9 % | ||
| CVE-2024-5953 | | 389-ds-base: malformed userpassword hash may cause denial of service | MEDIUM 5.7 | 0.6 % | ||
| CVE-2024-2199 | < 3.1.1 | 389-ds-base: malformed userpassword may cause crash at do_modify in slapd/modify.c | MEDIUM 5.7 | 0.6 % | ||
| CVE-2024-1062 | 1.4.3.0 – < 2.2.* | 389-ds-base: a heap overflow leading to denail-of-servce while writing a value larger than 256 chars (in log_entry_attr) | MEDIUM 5.5 | 0.3 % | ||
| CVE-2022-2850 | 389-ds-base-2.0.x+ | A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer derefere | MEDIUM 6.5 | 1.6 % | ||
| CVE-2022-1949 | 389-ds-base-2.0 | An access control bypass vulnerability found in 389-ds-base. That mishandling of the filter that would yield incorrect results, but as that | HIGH 7.5 | 1.5 % | ||
| CVE-2021-3652 | 389-ds-base 2.0.7 | A flaw was found in 389-ds-base. If an asterisk is imported as password hashes, either accidentally or maliciously, then instead of being in | MEDIUM 6.5 | 1.5 % | ||
| CVE-2022-0996 | 1.4 | A vulnerability was found in the 389 Directory Server that allows expired passwords to access the database to cause improper authentication. | MEDIUM 6.5 | 1.5 % | ||
| CVE-2022-0918 | 1.4 | A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to c | HIGH 7.5 | 5.9 % | ||
| CVE-2021-4091 | 389-ds-base-1.3.10.2 | A double-free was found in the way 389-ds-base handles virtual attributes context in persistent searches. An attacker could send a series of | HIGH 7.5 | 2.0 % | ||
| CVE-2021-3514 | 389-ds-base 1.4.3 | When using a sync_repl client in 389-ds-base, an authenticated attacker can cause a NULL pointer dereference using a specially crafted query | MEDIUM 6.5 | 1.2 % | ||
| CVE-2020-35518 | 389-ds-base 2.0.3, 389-ds-base 1.4.4.13, 389-ds-base 1.4.3.19 | When binding against a DN during authentication, the reply from 389-ds-base will be different whether the DN exists or not. This can be used | MEDIUM 5.3 | 1.5 % | ||
| CVE-2018-1089 | 389-ds-base 1.4.0.9 ; 389-ds-base 1.3.8.1 ; 389-ds-base 1.3.6.15 | 389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly | HIGH 7.5 | 4.0 % | ||
| CVE-2017-2591 | 389-ds-base 1.3.6 | 389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "a | HIGH 7.5 | 2.8 % |