Skip to content
Fencer Vulns
medium 5.7

CVE-2024-5953 json

389-ds-base: malformed userpassword hash may cause denial of service

published 2024-06-18 2 y ago modified 2026-11-07 46 h ago also EUVD-2024-47135

cvss
5.7
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 47%
public exploits
0
none known

Summary

A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.

Patch / fix

  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8 8060020250210084424.0ca98e7e
  • Red Hat Red Hat Directory Server 11.7 for RHEL 8 8080020240909040333.f969626e
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8 8100020240902112955.37ed7c03
  • Red Hat Red Hat Directory Server 12.2 EUS for RHEL 9 9020020240916150035.1674d574
  • Red Hat Red Hat Directory Server 12.4 for RHEL 9 9040020240723122852.1674d574
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:1.3.11.1-6.el7_9
  • Red Hat Red Hat Enterprise Linux 8 8100020240910065753.25e700aa
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support 8080020240807050952.6dbb3803
  • Red Hat Red Hat Enterprise Linux 9 0:2.4.5-9.el9_4
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support 0:2.2.4-9.el9_2
  • 389-ds-base Debian 12 2.3.1+dfsg1-1+deb12u1
  • 389-ds-base Debian 13 3.1.1+dfsg1-1

debian advisories DEBIAN-CVE-2024-5953

  • 389-ds-base directory server 11.9 1.4.3.39-5.module+el8dsrv+22259+114d7218
  • cockpit-389-ds directory server 11.9 1.4.3.39-5.module+el8dsrv+22259+114d7218
  • python3-lib389 directory server 11.9 1.4.3.39-5.module+el8dsrv+22259+114d7218
  • 389-ds-base-libs directory server 11.9 1.4.3.39-5.module+el8dsrv+22259+114d7218
  • 389-ds-base-snmp directory server 11.9 1.4.3.39-5.module+el8dsrv+22259+114d7218
  • 389-ds-base-legacy-tools directory server 11.9 1.4.3.39-5.module+el8dsrv+22259+114d7218
  • 389-ds-base RHEL 9 2.4.5-9.el9_4
  • python3-lib389 RHEL 9 2.4.5-9.el9_4

red hat advisories RHSA-2025:1632RHSA-2024:7458RHSA-2024:6568RHSA-2024:6153RHSA-2024:5690RHSA-2024:5192

  • 389-ds SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 2.2.10~git18.20ce9289-150600.8.10.1
  • 389-ds SLE Module for Server Applications 15 SP5, openSUSE Leap 15.5 2.2.10~git18.20ce9289-150500.3.24.1
  • 389-ds SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE High Performance Computing 15 SP3-LTSS +1 more 1.4.4.20~git3.e7ac6d87-150300.3.35.1
  • 389-ds SLES for SAP 15 SP4, SLES 15 SP4-LTSS, SLE High Performance Computing 15 SP4-LTSS +3 more 2.0.20~git9.5e2d637c-150400.3.42.3
  • 389-ds SLE Module for Server Applications 15 SP5, openSUSE Leap 15.5 2.2.10~git2.345056d3-150500.3.21.1
  • 389-ds SLE Module for Server Applications 15 SP6, openSUSE Leap 15.6 2.2.10~git2.345056d3-150600.8.7.2

suse advisories SUSE-SU-2024:3844-1SUSE-SU-2024:3843-1SUSE-SU-2024:3257-1SUSE-SU-2024:3218-1SUSE-SU-2024:3082-1SUSE-SU-2024:2910-1

  • 389-ds openSUSE Tumbleweed 3.1.1~git0.aef1668-1.1

opensuse advisories openSUSE-SU-2024:14227-1

  • 389-ds-base AlmaLinux 8 1.4.3.39-8.module_el8.10.0+3891+cbd883bf
  • python3-lib389 AlmaLinux 8 1.4.3.39-8.module_el8.10.0+3891+cbd883bf
  • 389-ds-base-libs AlmaLinux 8 1.4.3.39-8.module_el8.10.0+3891+cbd883bf
  • 389-ds-base-snmp AlmaLinux 8 1.4.3.39-8.module_el8.10.0+3891+cbd883bf
  • 389-ds-base-legacy-tools AlmaLinux 8 1.4.3.39-8.module_el8.10.0+3891+cbd883bf
  • 389-ds-base AlmaLinux 9 2.4.5-9.el9_4
  • python3-lib389 AlmaLinux 9 2.4.5-9.el9_4
  • 389-ds-base-libs AlmaLinux 9 2.4.5-9.el9_4

almalinux advisories ALSA-2024:6569ALSA-2024:5192

  • 389-ds-base Rocky Linux 8 1.4.3.39-8.module+el8.10.0+1866+6d9051ff
  • 389-ds-base Rocky Linux 9 2.4.5-9.el9_4

rocky linux advisories RLSA-2024:6569RLSA-2024:5192

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-5953 updated cvss 5.7

389-ds-base: Malformed userPassword hash may cause Denial of Service

  • Red Hat Enterprise Linux 6 389-ds-base, 389-ds-base-libs
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat Directory Server 11.5 E4S for RHEL 8 389-ds-base 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, cockpit-389-ds 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, python3-lib389 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, 389-ds-base-libs 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, 389-ds-base-snmp 1.4.3.34-4.module+el8dsrv+22781+5fe99dde, 389-ds-base-legacy-tools 1.4.3.34-4.module+el8dsrv+22781+5fe99dde
    fixed: vendor fix RHSA-2025:1632
  • Red Hat Directory Server 11.7 for RHEL 8 389-ds-base 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, cockpit-389-ds 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, python3-lib389 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, 389-ds-base-libs 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, 389-ds-base-snmp 1.4.3.34-4.module+el8dsrv+22274+a8abd89c, 389-ds-base-legacy-tools 1.4.3.34-4.module+el8dsrv+22274+a8abd89c
    fixed: vendor fix RHSA-2024:6576
  • Red Hat Directory Server 11.9 for RHEL 8 389-ds-base 1.4.3.39-5.module+el8dsrv+22259+114d7218, cockpit-389-ds 1.4.3.39-5.module+el8dsrv+22259+114d7218, python3-lib389 1.4.3.39-5.module+el8dsrv+22259+114d7218, 389-ds-base-libs 1.4.3.39-5.module+el8dsrv+22259+114d7218, 389-ds-base-snmp 1.4.3.39-5.module+el8dsrv+22259+114d7218, 389-ds-base-legacy-tools 1.4.3.39-5.module+el8dsrv+22259+114d7218
    fixed: vendor fix RHSA-2024:6568
  • Red Hat Directory Server 12.2 EUS for RHEL 9 389-ds-base 2.2.7-6.module+el9dsrv+22320+37c894f3, cockpit-389-ds 2.2.7-6.module+el9dsrv+22320+37c894f3, python3-lib389 2.2.7-6.module+el9dsrv+22320+37c894f3, 389-ds-base-libs 2.2.7-6.module+el9dsrv+22320+37c894f3, 389-ds-base-snmp 2.2.7-6.module+el9dsrv+22320+37c894f3
    fixed: vendor fix RHSA-2024:7458
  • Red Hat Directory Server 12.4 for RHEL 9 389-ds-base 2.4.5-7.module+el9dsrv+22137+7a1133f7, cockpit-389-ds 2.4.5-7.module+el9dsrv+22137+7a1133f7, python3-lib389 2.4.5-7.module+el9dsrv+22137+7a1133f7, 389-ds-base-libs 2.4.5-7.module+el9dsrv+22137+7a1133f7, 389-ds-base-snmp 2.4.5-7.module+el9dsrv+22137+7a1133f7
    fixed: vendor fix RHSA-2024:4997
  • Red Hat Enterprise Linux AppStream (v. 8) 389-ds-base 1.4.3.39-8.module+el8.10.0+22275+e4fc04d4, python3-lib389 1.4.3.39-8.module+el8.10.0+22275+e4fc04d4, 389-ds-base-libs 1.4.3.39-8.module+el8.10.0+22275+e4fc04d4, 389-ds-base-snmp 1.4.3.39-8.module+el8.10.0+22275+e4fc04d4, 389-ds-base-legacy-tools 1.4.3.39-8.module+el8.10.0+22275+e4fc04d4
    fixed: vendor fix RHSA-2024:6569
  • Red Hat Enterprise Linux AppStream (v. 9) 389-ds-base 2.4.5-9.el9_4, python3-lib389 2.4.5-9.el9_4, 389-ds-base-libs 2.4.5-9.el9_4
    fixed: vendor fix RHSA-2024:5192
show 5 more
  • Red Hat Enterprise Linux AppStream EUS (v.8.8) 389-ds-base 1.4.3.35-5.module+el8.8.0+22193+5f98570a, python3-lib389 1.4.3.35-5.module+el8.8.0+22193+5f98570a, 389-ds-base-libs 1.4.3.35-5.module+el8.8.0+22193+5f98570a, 389-ds-base-snmp 1.4.3.35-5.module+el8.8.0+22193+5f98570a, 389-ds-base-legacy-tools 1.4.3.35-5.module+el8.8.0+22193+5f98570a
    fixed: vendor fix RHSA-2024:5690
  • Red Hat Enterprise Linux AppStream EUS (v.9.2) 389-ds-base 2.2.4-9.el9_2, python3-lib389 2.2.4-9.el9_2, 389-ds-base-libs 2.2.4-9.el9_2
    fixed: vendor fix RHSA-2024:4633
  • Red Hat Enterprise Linux CRB (v. 9) 389-ds-base-devel 2.4.5-9.el9_4, 389-ds-base-debuginfo 2.4.5-9.el9_4, 389-ds-base-debugsource 2.4.5-9.el9_4, 389-ds-base-libs-debuginfo 2.4.5-9.el9_4, 389-ds-base-snmp-debuginfo 2.4.5-9.el9_4
    fixed: vendor fix RHSA-2024:5192
  • Red Hat Enterprise Linux Server (v. 7 ELS) 389-ds-base 1.3.11.1-6.el7_9, 389-ds-base-libs 1.3.11.1-6.el7_9 Red Hat Enterprise Linux Server Optional (v. 7 ELS) 389-ds-base 1.3.11.1-6.el7_9, 389-ds-base-libs 1.3.11.1-6.el7_9, 389-ds-base-snmp 1.3.11.1-6.el7_9
    fixed: vendor fix RHSA-2024:6153
  • Red Hat Enterprise Linux 10 389-ds-base
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 y ago

Exploit prediction

0.58% chance of exploitation in the next 30 days, higher than 47% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.7 CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Directory Server 11.5 E4S for RHEL 8
  • Red Hat Red Hat Directory Server 11.7 for RHEL 8
  • Red Hat Red Hat Directory Server 11.9 for RHEL 8
  • Red Hat Red Hat Directory Server 12.2 EUS for RHEL 9
  • Red Hat Red Hat Directory Server 12.4 for RHEL 9
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.8 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-1288 Improper Validation of Consistency within Input

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.