Multiple memory leaks in the normalization functionality in 389 Directory Server before 1.2.7.5 allow remote attackers to cause a denial of

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• fedoraproject 389 directory serverup to 1.2.7 inclusive
• fedoraproject 389 directory server1.2.1
• fedoraproject 389 directory server1.2.2
• fedoraproject 389 directory server1.2.3
• fedoraproject 389 directory server1.2.5
• fedoraproject 389 directory server1.2.6
• fedoraproject 389 directory server1.2.6.1

Other highest-scoring records for the same primary product.

• CVE-2017-7551389-ds-base version before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different retur
  39Monitor
• CVE-2017-15135It was found that 389-ds-base since 1.3.6.1 up to and including 1.4.0.3 did not always handle internal hash comparison operations correctly
  33Monitor
• CVE-2019-3883In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads.
  32Monitor
• CVE-2018-14648A flaw was found in 389 Directory Server.
  32Monitor
• CVE-2018-14638A flaw was found in 389-ds-base before version 1.3.8.4-13.
  31Monitor
• CVE-2018-14624A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16.
  31Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.

MITRE has no CAPEC/ATT&CK mapping for this CWE.