CVE-2024-3657

HighCVSS 7.5/10Last modified Nov 4, 2026

Description

A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-20

Affected software

VendorProductVersions
Red HatRed Hat Directory Server 11.5 E4S for RHEL 8—
Red HatRed Hat Directory Server 11.7 for RHEL 8—
Red HatRed Hat Directory Server 11.8 for RHEL 8—
Red HatRed Hat Directory Server 11.9 for RHEL 8—
Red HatRed Hat Directory Server 12.2 EUS for RHEL 9—
Red HatRed Hat Directory Server 12.4 for RHEL 9—
Red HatRed Hat Enterprise Linux 7—
Red HatRed Hat Enterprise Linux 8—
Red HatRed Hat Enterprise Linux 8.8 Extended Update Support—
Red HatRed Hat Enterprise Linux 9—
Red HatRed Hat Enterprise Linux 9.2 Extended Update Support—
Red HatRed Hat Enterprise Linux 10—
Red HatRed Hat Enterprise Linux 6—

References

Timeline

Published
May 28, 2024
Last modified
Nov 4, 2026
NVD status
Deferred

Related CVEs from 2024

CVE-2024-365729.8Prototype pollution in allpro form-manager 0.7.4 allows attackers to run arbitrary code and cause other impacts via the functions setDefaultCVE-2024-365739.8almela obx before v.0.0.4 has a Prototype Pollution issue which allows arbitrary code execution via the obx/build/index.js:656), reduce (@alCVE-2024-365746.3A Prototype Pollution issue in flatten-json 1.0.1 allows an attacker to execute arbitrary code via module.exports.unflattenJSON (flatten-jsoCVE-2024-365759.8A Prototype Pollution issue in getsetprop 1.1.0 allows an attacker to execute arbitrary code via global.accessor.CVE-2024-365778.3apphp js-object-resolver < 3.1.1 is vulnerable to Prototype Pollution via Module.setNestedProperty.CVE-2024-365785.9akbr update 1.0.0 is vulnerable to Prototype Pollution via update/index.js.CVE-2024-365809.8A Prototype Pollution issue in cdr0 sg 1.0.10 allows an attacker to execute arbitrary code.CVE-2024-365817.6A Prototype Pollution issue in abw badger-database 1.2.1 allows an attacker to execute arbitrary code via dist/badger-database.esm.CVE-2024-365829.8alexbinary object-deep-assign 1.0.11 is vulnerable to Prototype Pollution via the extend() method of Module.deepAssign (/src/index.js)CVE-2024-365838.1A Prototype Pollution issue in byondreal accessor <= 1.0.0 allows an attacker to execute arbitrary code via @byondreal/accessor/index.CVE-2024-365868.8An issue in AdGuardHome v0.93 to latest allows unprivileged attackers to escalate privileges via overwriting the AdGuardHome binary.CVE-2024-365877.8Insecure permissions in DNSCrypt-proxy v2.0.0alpha9 to v2.1.5 allows non-privileged attackers to escalate privileges to root via overwriting
CVE-2024-3657: High severity, CVSS 7.5 | Vulnix