PT-2019-16752 · Red Hat+4 · 389-Ds-Base+5

Tbordaz + 1 · Published 2019-04-17 · Updated 2023-04-24 · CVE-2019-3883

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions 389-ds-base versions 1.4.1.2 and earlier

Description The issue allows an unauthenticated attacker to create hanging LDAP requests, potentially hanging all worker threads and resulting in a Denial of Service. This occurs because connections using SSL/TLS do not take into account the 'ioblocktimeout' during reads, unlike un-encrypted requests.

Recommendations For 389-ds-base versions 1.4.1.2 and earlier, consider disabling SSL/TLS connections or restricting the use of LDAP requests until a patch is available. As a temporary workaround, adjust the 'ioblocktimeout' value to minimize the risk of exploitation.

Fix

DoS

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

ALT-PU-2019-2649

ALT-PU-2019-3188

CESA-2019_1896

CESA-2019_3401

CVE-2019-3883

DLA-1779-1

DLA-3399-1

MGASA-2019-0411

RHSA-2019:1896

RHSA-2019:3401

RHSA-2019_1896

RHSA-2019_3401

SUSE-SU-2019:2155-1

Affected Products

389-Ds-Base

Alt Linux

Astra Linux

Centos

Red Hat

Suse

References · 44

• https://advisories.mageia.org/MGASA-2019-0411.html · Security Note
• https://osv.dev/vulnerability/DLA-3399-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2019-3883 · Security Note
• https://osv.dev/vulnerability/MGASA-2019-0411 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2019:3401 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-3883 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2019-3883 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-1779-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2019-3883 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-3883 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2155-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-3883 · Security Note
• https://access.redhat.com/errata/RHSA-2019:1896 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-3883 · Vendor Advisory
• https://suse.com/security/cve/CVE-2018-14648 · Note