CVE-2017-2591

LOW

Fedoraproject 389 Directory Server < 1.3.6 - Heap Buffer Overflow

Title source: rule
STIX 2.1

Description

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the "attribute uniqueness" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.

References (3)

Core 3
Core References
Patch, Third Party Advisory x_refsource_confirm
https://pagure.io/389-ds-base/issue/48986
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/95670

Scores

CVSS v3 3.7
EPSS 0.0277
EPSS Percentile 86.1%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

Details

CWE
CWE-125 CWE-122
Status published
Products (2)
fedoraproject/389_directory_server < 1.3.6
redhat/enterprise_linux 7.0
Published Apr 30, 2018
Tracked Since Feb 18, 2026