CVE-2017-2591

2018-04-3012:00:00

CWE-122

redhat

www.cve.org

CVSS3

3.7

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

LOW

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L

AI Score

7.7

Confidence

High

EPSS

0.002

Percentile

59.1%

JSON

389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the “attribute uniqueness” plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.

CNA Affected

[
  {
    "product": "389-ds-base",
    "vendor": "unspecified",
    "versions": [
      {
        "status": "affected",
        "version": "389-ds-base 1.3.6"
      }
    ]
  }
]