PT-2024-5923 · Unknown+2 · 389-Ds-Base+2

Published 2024-09-05 · Updated 2025-03-16 · CVE-2024-8445

Positive Technologies (AI Summary)

CVSS v3.1

5.7

Medium

Base vector

AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions 389-ds-base versions prior to the fixed version

Description The issue arises from insufficient input validation, allowing an authenticated user to cause a server crash by modifying the userPassword using malformed input. This can lead to a denial of service, resulting in system unavailability.

Recommendations For versions prior to the fixed version, patch immediately to resolve the issue. As a temporary workaround, consider restricting access to the userPassword parameter to minimize the risk of exploitation. Limit local network access to reduce the potential impact of the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-06729

CVE-2024-8445

DLA-4021-1

OESA-2025-1145

OESA-2025-1146

OESA-2025-1147

RHSA-2024:7434

Affected Products

389-Ds-Base

Astra Linux

Debian

References · 26

• 🔥 https://github.com/NathanMulbrook/CVE-2022-0918 · Exploit
• https://osv.dev/vulnerability/DLA-4021-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-8445 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2024-8445 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1145 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-8445 · Vendor Advisory
• https://osv.dev/vulnerability/OESA-2025-1146 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-8445 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-8445 · Security Note
• https://linux.oracle.com/errata/ELSA-2024-7434.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-8445 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2024:7434 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06729 · Security Note
• https://osv.dev/vulnerability/OESA-2025-1147 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-8445 · Vendor Advisory