389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.
References
| Link | Resource |
|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00033.html | |
| https://access.redhat.com/errata/RHSA-2018:2757 | Third Party Advisory |
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-10850 | Issue Tracking Third Party Advisory |
| https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html | Third Party Advisory |
| https://pagure.io/389-ds-base/c/8f04487f99a | Patch Third Party Advisory |
| https://pagure.io/389-ds-base/issue/49768 | Issue Tracking Third Party Advisory |
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
History
No history.
Information
Published : 2018-06-13 20:29
Updated : 2024-02-04 19:46
NVD link : CVE-2018-10850
Mitre link : CVE-2018-10850
CVE.ORG link : CVE-2018-10850
JSON object : View
Products Affected
debian
- debian_linux
redhat
- enterprise_linux_server_tus
- enterprise_linux_server_aus
- enterprise_linux_workstation
- enterprise_linux_server
- enterprise_linux_server_eus
- enterprise_linux
- enterprise_linux_desktop
fedoraproject
- 389_directory_server
CWE
CWE-362
Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')