PT-2022-6594 · Red Hat+5 · 389 Directory Server+6

Tbordaz · Published 2022-03-15 · Updated 2025-01-20 · CVE-2022-0918

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions 389 Directory Server (affected versions not specified)

Description A vulnerability was discovered in the 389 Directory Server that allows an unauthenticated attacker with network access to the LDAP port to cause a denial of service. The denial of service is triggered by a single message sent over a TCP connection, no bind or other authentication is required. The message triggers a segmentation fault that results in slapd crashing.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

ALSA-2022:5823

ALSA-2022:8162

ALSA-2022_0889

ALSA-2022_5823

ALSA-2024_3837

ALSA-2024_4235

ALSA-2024_5192

ALSA-2024_6569

BDU:2023-02637

CESA-2022_5239

CESA-2022_5823

CVE-2022-0918

DLA-3399-1

DLA-4021-1

ELSA-2022-5239

ELSA-2022-5823

ELSA-2022-8162

MGASA-2022-0134

OPENSUSE-SU-2022:1100-1

OPENSUSE-SU-2022_1100-1

OPENSUSE-SU-2024:11963-1

RHSA-2022:2210

RHSA-2022:5239

RHSA-2022:5620

RHSA-2022:5823

RHSA-2022:8162

RHSA-2022:8976

RHSA-2022_5239

RHSA-2022_5823

RHSA-2022_8162

RLSA-2022:5823

RLSA-2022:8162

RLSA-2022_5823

RLSA-2022_8162

SUSE-SU-2022:1100-1

SUSE-SU-2022:1102-1

SUSE-SU-2022:1139-1

SUSE-SU-2022:2163-1

SUSE-SU-2022_1100-1

SUSE-SU-2022_1102-1

SUSE-SU-2022_1139-1

SUSE-SU-2022_2163-1

Affected Products

389 Directory Server

Almalinux

Astra Linux

Centos

Red Hat

Rocky Linux

Suse

References · 79

• 🔥 https://github.com/NathanMulbrook/CVE-2022-0918 · Exploit
• https://github.com/389ds/389-ds-base/issues/5242 · Patch
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2023-0727SE47 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2022-0918 · Vendor Advisory
• https://errata.almalinux.org/9/ALSA-2022-8162.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2022-0918 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1102-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2022-5239.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:1139-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-0918 · Security Note
• https://cve.org/CVERecord?id=CVE-2022-0918 · Security Note
• https://osv.dev/vulnerability/DLA-3399-1 · Vendor Advisory
• https://errata.almalinux.org/8/ALSA-2022-5823.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2022:1100-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2022-0134.html · Security Note