CVE-2019-3883

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-772

Affected software

Vendor	Product	Versions
Red Hat	389-ds-base	affects up to 1.4.1.2

References

https://access.redhat.com/errata/RHSA-2019:1896Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3401Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00008.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://pagure.io/389-ds-base/issue/50329Issue Tracking, Third Party Advisory
https://pagure.io/389-ds-base/pull-request/50331Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:1896Third Party Advisory
https://access.redhat.com/errata/RHSA-2019:3401Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883Issue Tracking, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2019/05/msg00008.htmlMailing List, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00026.html
https://pagure.io/389-ds-base/issue/50329Issue Tracking, Third Party Advisory
https://pagure.io/389-ds-base/pull-request/50331Third Party Advisory

Timeline

Published: Apr 17, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-38845.4A vulnerability exists in the garbage collection mechanism of atomic-openshift. An attacker able spoof the UUID of a valid object from anoth CVE-2019-38857.5A use-after-free flaw was found in pacemaker up to and including version 2.0.1 which could result in certain sensitive information to be lea CVE-2019-38865.4An incorrect permissions check was discovered in libvirt 4.8.0 and above. The readonly permission was allowed to invoke APIs depending on th CVE-2019-38875.6A flaw was found in the way KVM hypervisor handled x2APIC Machine Specific Rregister (MSR) access with nested(=1) virtualization enabled. In CVE-2019-38889.8A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because CVE-2019-38895.4A reflected XSS vulnerability exists in authorization flow of OpenShift Container Platform versions: openshift-online-3, openshift-enterpris CVE-2019-38908.1It was discovered evolution-ews before 3.31.3 does not check the validity of SSL certificates. An attacker could abuse this flaw to get conf CVE-2019-38917.8It was discovered that a world-readable log file belonging to Candlepin component of Red Hat Satellite 6.4 leaked the credentials of the Can CVE-2019-38934.9In Foreman it was discovered that the delete compute resource operation, when executed from the Foreman API, leads to the disclosure of the CVE-2019-38948.8It was discovered that the ElytronManagedThread in Wildfly's Elytron subsystem in versions from 11 to 16 stores a SecurityIdentity to run th CVE-2019-38958.0An access-control flaw was found in the Octavia service when the cloud platform was deployed using Red Hat OpenStack Platform Director. An a CVE-2019-38967.8A double-free can happen in idr_remove_all() in lib/idr.c in the Linux kernel 2.6 branch. An unprivileged local attacker can use this flaw f