PT-2022-4672 · Unknown+7 · 389-Ds-Base+7

Cedric Buissart · Published 2019-02-11 · Updated 2025-01-20 · CVE-2021-4091

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions 389-ds-base (affected versions not specified)

Description A double-free issue was found in the way 389-ds-base handles virtual attributes context in persistent searches. This could allow an attacker to send a series of search requests, forcing the server to behave unexpectedly and crash. The vulnerability is related to the use of memory after it has been freed when handling private pblock and duplicated pblock with the same pb vattr context pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Double Free

Use After Free

Weakness Enumeration

CWE-415

CWE-416

Related Identifiers

ALSA-2022:0889

ALT-PU-2019-1207

BDU:2022-05559

CESA-2022_0628

CESA-2022_0889

CVE-2021-4091

DLA-3399-1

DLA-4021-1

MGASA-2022-0106

OPENSUSE-SU-2022_2081-1

OPENSUSE-SU-2022_2295-1

RHSA-2022:0628

RHSA-2022:0889

RHSA-2022:0952

RHSA-2022:1410

RHSA-2022_0628

RHSA-2022_0889

RLSA-2022:0889

SUSE-SU-2022:2081-1

SUSE-SU-2022:2105-1

SUSE-SU-2022:2109-1

SUSE-SU-2022:2163-1

SUSE-SU-2022:2295-1

SUSE-SU-2022_2081-1

SUSE-SU-2022_2105-1

SUSE-SU-2022_2295-1

Affected Products

389-Ds-Base

Alt Linux

Almalinux

Astra Linux

Centos

Red Hat

Rocky Linux

Suse

References · 56

• 🔥 https://github.com/NathanMulbrook/CVE-2022-0918 · Exploit
• https://osv.dev/vulnerability/RLSA-2022:0889 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-4091 · Security Note
• https://osv.dev/vulnerability/CVE-2021-4091 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-4021-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-4091 · Security Note
• https://bugzilla.redhat.com/show_bug.cgi?id=2030307 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:0889 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-05559 · Security Note
• https://osv.dev/vulnerability/DLA-3399-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2109-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-4091 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2023-0426SE17 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2163-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2295-1 · Vendor Advisory