CVE-2018-10850

389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds...

5.9 MediumFix available

389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds-base handles persistent search, resulting in a crash if the server is under load. An anonymous attacker could use this flaw to trigger a denial of service.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

1.54%Down 0.3 points since Apr 14, 2021

What each source reports

CVE List Score used 5.9

Record: CVE-2018-10850
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

EUVDEUVD-2018-2919 5.9

Record: EUVD-2018-2919
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-03

GitHub AdvisoriesGHSA-x8cw-gcmf-hx8h 5.9

389-ds-base before versions 1.4.0.10, 1.3.8.3 is vulnerable to a race condition in the way 389-ds...

Record: GHSA-x8cw-gcmf-hx8h
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-362
Updated: 2026-11-02

NVD 5.9

Record: CVE-2018-10850
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.0: 7.1 HighAV:N/AC:M/Au:N/C:N/I:N/A:C
Weakness: CWE-362
Updated: 2026-11-02

OSV 5.9

Record: CVE-2018-10850
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVDEBIAN-CVE-2018-10850 5.9

Record: DEBIAN-CVE-2018-10850
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 7 moreShow less

OSVRHSA-2018:2757 7.5

Red Hat Security Advisory: 389-ds-base security and bug fix update

Record: RHSA-2018:2757
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVUBUNTU-CVE-2018-10850 5.9

Record: UBUNTU-CVE-2018-10850
CVSS 3.0: 5.9 MediumCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVMGASA-2018-0404 No score

Updated 389-ds-base packages fix security vulnerabilities

Updated 389-ds-base package fixes security vulnerabilities:

a race condition on reference counter leads to DoS using persistent search (CVE-2018-10850)

ldapsearch with server side sort allows users to cause a crash (CVE-2018-10935)

a server crash through the modify command with large DN (CVE-2018-14624)

Record: MGASA-2018-0404
Updated: 2026-11-02

OSVopenSUSE-SU-2019:1397-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

The following security vulnerabilities were addressed:

CVE-2018-10850: Fixed a race condition on reference counter that would lead to a denial of service using persistent search (bsc#1096368)
CVE-2017-15134: Fixed a remote denial of service via search filters in slapi_filter_sprintf in slapd/util.c (bsc#1076530)
CVE-2017-15135: Fixed authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (bsc#1076530)
CVE-2018-10935: Fixed an issue that allowed users to cause a crash via ldapsearch with server side sorts (bsc#1105606)
CVE-2018-14624: The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(), allowing an attacker to send a flood of modifications to a very large DN, which could have caused slapd to crash (bsc#1106699).

This update was imported from the SUSE:SLE-15:Update update project.

Record: openSUSE-SU-2019:1397-1
Updated: 2026-11-02

OSVopenSUSE-SU-2024:10593-1 No score

389-ds-2.0.10~git0.21dd2802c-1.1 on GA media

These are all security issues fixed in the 389-ds-2.0.10~git0.21dd2802c-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2024:10593-1
Updated: 2026-11-02

OSVSUSE-SU-2019:1207-1 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

The following security vulnerabilities were addressed:

CVE-2018-10850: Fixed a race condition on reference counter that would lead to a denial of service using persistent search (bsc#1096368)
CVE-2017-15134: Fixed a remote denial of service via search filters in slapi_filter_sprintf in slapd/util.c (bsc#1076530)
CVE-2017-15135: Fixed authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (bsc#1076530)
CVE-2018-10935: Fixed an issue that allowed users to cause a crash via ldapsearch with server side sorts (bsc#1105606)
CVE-2018-14624: The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(), allowing an attacker to send a flood of modifications to a very large DN, which could have caused slapd to crash (bsc#1106699).

Record: SUSE-SU-2019:1207-1
Updated: 2026-11-02

OSVSUSE-SU-2019:1207-2 No score

Security update for 389-ds

This update for 389-ds fixes the following issues:

The following security vulnerabilities were addressed:

CVE-2018-10850: Fixed a race condition on reference counter that would lead to a denial of service using persistent search (bsc#1096368)
CVE-2017-15134: Fixed a remote denial of service via search filters in slapi_filter_sprintf in slapd/util.c (bsc#1076530)
CVE-2017-15135: Fixed authentication bypass due to lack of size check in slapi_ct_memcmp function in ch_malloc.c (bsc#1076530)
CVE-2018-10935: Fixed an issue that allowed users to cause a crash via ldapsearch with server side sorts (bsc#1105606)
CVE-2018-14624: The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(), allowing an attacker to send a flood of modifications to a very large DN, which could have caused slapd to crash (bsc#1106699).

Record: SUSE-SU-2019:1207-2
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`389-ds-base` Debian:12	before 1.4.0.15-1	1.4.0.15-1
`389-ds-base` Debian:13	before 1.4.0.15-1	1.4.0.15-1
`389-ds-base` Debian:8 From an advisory covering 5 CVEs	before 1.3.3.5-4+deb8u1, plus listed versions 1.3.3.5-4	1.3.3.5-4+deb8u1
`389-ds-base` Mageia:6 From an advisory covering 3 CVEs	before 1.3.5.17-1.6.mga6	1.3.5.17-1.6.mga6
`389-ds-base` Red Hat:enterprise_linux:7::client From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-debuginfo` Red Hat:enterprise_linux:7::client From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-devel` Red Hat:enterprise_linux:7::client From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-libs` Red Hat:enterprise_linux:7::client From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-snmp` Red Hat:enterprise_linux:7::client From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base` Red Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5

Show 21 moreShow less

Affected packages
Package	Affected	Fixed
`389-ds-base-debuginfo` Red Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-devel` Red Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-libs` Red Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-snmp` Red Hat:enterprise_linux:7::computenode From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base` Red Hat:enterprise_linux:7::server From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-debuginfo` Red Hat:enterprise_linux:7::server From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-libs` Red Hat:enterprise_linux:7::server From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-devel` Red Hat:enterprise_linux:7::server From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-snmp` Red Hat:enterprise_linux:7::server From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base` Red Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-debuginfo` Red Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-libs` Red Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-devel` Red Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds-base-snmp` Red Hat:enterprise_linux:7::workstation From an advisory covering 4 CVEs	before 0:1.3.7.5-28.el7_5	0:1.3.7.5-28.el7_5
`389-ds` SUSE:Linux Enterprise Module for Server Applications 15 From an advisory covering 5 CVEs	before 1.4.0.3-4.7.52	1.4.0.3-4.7.52
`389-ds` SUSE:Linux Enterprise Module for Server Applications 15 SP1 From an advisory covering 5 CVEs	before 1.4.0.3-4.7.52	1.4.0.3-4.7.52
`389-ds-base` Ubuntu:Pro:16.04:LTS	All versions, plus listed versions 1.3.3.12-1build11.3.3.13-11.3.4.5-21.3.4.8-11.3.4.8-3 Show 4 moreShow less 1.3.4.8-3ubuntu11.3.4.8-41.3.4.9-11.3.4.9-1ubuntu0.1~esm1	None known
`389-ds-base` Ubuntu:Pro:18.04:LTS	All versions, plus listed versions 1.3.7.5-11.3.7.5-1build11.3.7.5-1build21.3.7.9-11.3.7.10-11.3.7.10-1ubuntu11.3.7.10-1ubuntu1+esm1	None known
`389-ds-base` Ubuntu:26.04:LTS	All versions, plus listed versions 3.1.2+dfsg1-13.1.2+vendor1-2	None known
`389-ds` openSUSE:Leap 15.0 From an advisory covering 5 CVEs	before 1.4.0.3-lp150.3.3.1	1.4.0.3-lp150.3.3.1
`389-ds` openSUSE:Tumbleweed From an advisory covering 11 CVEs	before 2.0.10~git0.21dd2802c-1.1	2.0.10~git0.21dd2802c-1.1

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2018-10850 is a medium vulnerability (CVSS 5.9) in [unknown] 389-ds-base, published June 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.54%, the 75th percentile. Fixed in 389-ds-base 1.4.0.15-1.

References

Show 46 moreShow less