Skip to content
Fencer Vulns
high 7.5

CVE-2024-3657 json

389-ds-base: potential denial of service via specially crafted kerberos as-req request

published 2024-05-28 2 y ago modified 2026-11-04 4 d ago also EUVD-2024-32233

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.3%
EPSS 1.3% chance of exploitation in 30 days, percentile 70%
public exploits
0
none known

Summary

A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service

Patch / fix

  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 8060020250210084424.0ca98e7e
  • Red Hat Red Hat Directory Server 11.7 for RHEL 8 8080020240909040333.f969626e
  • Red Hat Red Hat Directory Server 11.8 for RHEL 8 8090020240606122459.91529cd0
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8 8100020240604161237.37ed7c03
  • Red Hat Red Hat Directory Server 12.2 EUS for RHEL 9 9020020240916150035.1674d574
  • Red Hat Red Hat Directory Server 12.4 for RHEL 9 9040020240604143706.1674d574
  • Red Hat Red Hat Enterprise Linux 7 0:1.3.11.1-5.el7_9
  • Red Hat Red Hat Enterprise Linux 8 8100020240613122040.25e700aa
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 8080020240807050952.6dbb3803
  • Red Hat Red Hat Enterprise Linux 9 0:2.4.5-8.el9_4
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:2.2.4-9.el9_2
  • 389-ds-base Debian 12 2.3.1+dfsg1-1+deb12u1
  • 389-ds-base Debian 13 3.1.1+dfsg1-1

debian advisories DEBIAN-CVE-2024-3657

  • 389-ds-base RHEL 9 2.4.5-8.el9_4
  • python3-lib389 RHEL 9 2.4.5-8.el9_4
  • 389-ds-base-libs RHEL 9 2.4.5-8.el9_4
  • 389-ds-base RHEL 7 1.3.11.1-5.el7_9
  • 389-ds-base-libs RHEL 7 1.3.11.1-5.el7_9
  • 389-ds-base-snmp RHEL 7 1.3.11.1-5.el7_9
  • 389-ds-base RHEL 8 1.4.3.39-7.module+el8.10.0+21985+3665ccdb
  • python3-lib389 RHEL 8 1.4.3.39-7.module+el8.10.0+21985+3665ccdb

red hat advisories RHSA-2025:1632RHSA-2024:7458RHSA-2024:5690RHSA-2024:3837RHSA-2024:4633RHSA-2024:3591

  • 389-ds SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 2.2.10~git18.20ce9289-150600.8.10.1
  • 389-ds SLE Module for Server Applications 15 SP5, openSUSE Leap 15.5 2.2.10~git18.20ce9289-150500.3.24.1
  • 389-ds SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.4.4.20~git3.e7ac6d87-150300.3.35.1
  • 389-ds SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 2.0.20~git9.5e2d637c-150400.3.42.3
  • 389-ds SLE Module for Server Applications 15 SP5, openSUSE Leap 15.5 2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 2.2.10~git2.345056d3-150600.8.7.2

suse advisories SUSE-SU-2024:3844-1SUSE-SU-2024:3843-1SUSE-SU-2024:3257-1SUSE-SU-2024:3218-1SUSE-SU-2024:3082-1SUSE-SU-2024:2910-1

  • 389-ds openSUSE Tumbleweed 3.1.1~git0.aef1668-1.1

opensuse advisories openSUSE-SU-2024:14227-1

  • 389-ds-base AlmaLinux 8 1.4.3.39-7.module_el8.10.0+3864+d8eec553
  • python3-lib389 AlmaLinux 8 1.4.3.39-7.module_el8.10.0+3864+d8eec553
  • 389-ds-base-libs AlmaLinux 8 1.4.3.39-7.module_el8.10.0+3864+d8eec553
  • 389-ds-base-snmp AlmaLinux 8 1.4.3.39-7.module_el8.10.0+3864+d8eec553
  • 389-ds-base-legacy-tools AlmaLinux 8 1.4.3.39-7.module_el8.10.0+3864+d8eec553
  • 389-ds-base AlmaLinux 9 2.4.5-8.el9_4
  • python3-lib389 AlmaLinux 9 2.4.5-8.el9_4
  • 389-ds-base-libs AlmaLinux 9 2.4.5-8.el9_4

almalinux advisories ALSA-2024:4235ALSA-2024:3837

  • 389-ds-base Rocky Linux 8 1.4.3.39-7.module+el8.10.0+1832+2f5a9255
  • 389-ds-base Rocky Linux 9 2.4.5-8.el9_4

rocky linux advisories RLSA-2024:4235RLSA-2024:3837

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-3657 updated cvss 7.5

389-ds-base: potential denial of service via specially crafted kerberos AS-REQ request

  • Red Hat Enterprise Linux 6 389-ds-base, 389-ds-base-libs
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, cockpit-389-ds 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, python3-lib389 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, 389-ds-base-libs 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, 389-ds-base-snmp 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, 389-ds-base-legacy-tools 1.4.3.34-4.module+el8dsrv+22781+5fe99dde
    fixed: vendor fix RHSA-2025:1632
  • Red Hat Directory Server 11.7 for RHEL 8 389-ds-base 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, cockpit-389-ds 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, python3-lib389 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, 389-ds-base-libs 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, 389-ds-base-snmp 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, 389-ds-base-legacy-tools 1.4.3.34-4.module+el8dsrv+22274+a8abd89c
    fixed: vendor fix RHSA-2024:6576
  • Red Hat Directory Server 11.8 for RHEL 8 389-ds-base 1.4.3.37-10.module+el8dsrv+21971+f7435891, cockpit-389-ds 1.4.3.37-10.module+el8dsrv+21971+f7435891, python3-lib389 1.4.3.37-10.module+el8dsrv+21971+f7435891, 389-ds-base-libs 1.4.3.37-10.module+el8dsrv+21971+f7435891, 389-ds-base-snmp 1.4.3.37-10.module+el8dsrv+21971+f7435891, 389-ds-base-legacy-tools 1.4.3.37-10.module+el8dsrv+21971+f7435891
    fixed: vendor fix RHSA-2024:4209
  • Red Hat Directory Server 11.9 for RHEL 8 389-ds-base 1.4.3.39-4.module+el8dsrv+21965+9ff26197, cockpit-389-ds 1.4.3.39-4.module+el8dsrv+21965+9ff26197, python3-lib389 1.4.3.39-4.module+el8dsrv+21965+9ff26197, 389-ds-base-libs 1.4.3.39-4.module+el8dsrv+21965+9ff26197, 389-ds-base-snmp 1.4.3.39-4.module+el8dsrv+21965+9ff26197, 389-ds-base-legacy-tools 1.4.3.39-4.module+el8dsrv+21965+9ff26197
    fixed: vendor fix RHSA-2024:4210
  • Red Hat Directory Server 12.2 EUS for RHEL 9 389-ds-base 2.2.7-6.module+el9dsrv+22320+37c894f3, cockpit-389-ds 2.2.7-6.module+el9dsrv+22320+37c894f3, python3-lib389 2.2.7-6.module+el9dsrv+22320+37c894f3, 389-ds-base-libs 2.2.7-6.module+el9dsrv+22320+37c894f3, 389-ds-base-snmp 2.2.7-6.module+el9dsrv+22320+37c894f3
    fixed: vendor fix RHSA-2024:7458
  • Red Hat Directory Server 12.4 for RHEL 9 389-ds-base 2.4.5-4.module+el9dsrv+21964+c7e95493, cockpit-389-ds 2.4.5-4.module+el9dsrv+21964+c7e95493, python3-lib389 2.4.5-4.module+el9dsrv+21964+c7e95493, 389-ds-base-libs 2.4.5-4.module+el9dsrv+21964+c7e95493, 389-ds-base-snmp 2.4.5-4.module+el9dsrv+21964+c7e95493
    fixed: vendor fix RHSA-2024:4092
  • Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base 1.4.3.39-7.module+el8.10.0+21985+3665ccdb, python3-lib389 1.4.3.39-7.module+el8.10.0+21985+3665ccdb, 389-ds-base-libs 1.4.3.39-7.module+el8.10.0+21985+3665ccdb, 389-ds-base-snmp 1.4.3.39-7.module+el8.10.0+21985+3665ccdb, 389-ds-base-legacy-tools 1.4.3.39-7.module+el8.10.0+21985+3665ccdb
    fixed: vendor fix RHSA-2024:4235
show 7 more
  • Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base 2.4.5-8.el9_4, python3-lib389 2.4.5-8.el9_4, 389-ds-base-libs 2.4.5-8.el9_4
    fixed: vendor fix RHSA-2024:3837
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) 389-ds-base 1.4.3.35-5.module+el8.8.0+22193+5f98570a, python3-lib389 1.4.3.35-5.module+el8.8.0+22193+5f98570a, 389-ds-base-libs 1.4.3.35-5.module+el8.8.0+22193+5f98570a, 389-ds-base-snmp 1.4.3.35-5.module+el8.8.0+22193+5f98570a, 389-ds-base-legacy-tools 1.4.3.35-5.module+el8.8.0+22193+5f98570a
    fixed: vendor fix RHSA-2024:5690
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) 389-ds-base 2.2.4-9.el9_2, python3-lib389 2.2.4-9.el9_2, 389-ds-base-libs 2.2.4-9.el9_2
    fixed: vendor fix RHSA-2024:4633
  • Red Hat Enterprise Linux Client Optional (v. 7) 389-ds-base 1.3.11.1-5.el7_9, 389-ds-base-libs 1.3.11.1-5.el7_9, 389-ds-base-snmp 1.3.11.1-5.el7_9 Red Hat Enterprise Linux ComputeNode Optional (v. 7) 389-ds-base 1.3.11.1-5.el7_9, 389-ds-base-libs 1.3.11.1-5.el7_9, 389-ds-base-snmp 1.3.11.1-5.el7_9
    fixed: vendor fix RHSA-2024:3591
  • Red Hat Enterprise Linux CRB (v. 9) 389-ds-base-devel 2.4.5-8.el9_4, 389-ds-base-debuginfo 2.4.5-8.el9_4, 389-ds-base-debugsource 2.4.5-8.el9_4, 389-ds-base-libs-debuginfo 2.4.5-8.el9_4, 389-ds-base-snmp-debuginfo 2.4.5-8.el9_4
    fixed: vendor fix RHSA-2024:3837
  • Red Hat Enterprise Linux Server (v. 7) 389-ds-base 1.3.11.1-5.el7_9, 389-ds-base-libs 1.3.11.1-5.el7_9 Red Hat Enterprise Linux Server Optional (v. 7) 389-ds-base 1.3.11.1-5.el7_9, 389-ds-base-libs 1.3.11.1-5.el7_9, 389-ds-base-snmp 1.3.11.1-5.el7_9 Red Hat Enterprise Linux Workstation (v. 7) 389-ds-base 1.3.11.1-5.el7_9, 389-ds-base-libs 1.3.11.1-5.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) 389-ds-base-snmp 1.3.11.1-5.el7_9
    fixed: vendor fix RHSA-2024:3591
  • Red Hat Enterprise Linux 10 389-ds-base
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.28% chance of exploitation in the next 30 days, higher than 70% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8
  • Red Hat Red Hat Directory Server 11.7 for RHEL 8
  • Red Hat Red Hat Directory Server 11.8 for RHEL 8
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8
  • Red Hat Red Hat Directory Server 12.2 EUS for RHEL 9
  • Red Hat Red Hat Directory Server 12.4 for RHEL 9
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.