CVE-2024-8445
389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
CVE-2024-8445- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-05
EUVDEUVD-2024-49545
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
EUVD-2024-49545- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-05
GitHub AdvisoriesGHSA-9q6m-vr5h-rqq5
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain...
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
GHSA-9q6m-vr5h-rqq5- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
CVE-2024-8445- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-05
OSV
389-ds-base: server crash while modifying `userpassword` using malformed input (incomplete fix for cve-2024-2199)
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
CVE-2024-8445- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-20
- Updated
- 2026-11-07
OSVDEBIAN-CVE-2024-8445
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
DEBIAN-CVE-2024-8445- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVOESA-2025-1145
three-eight-nine-ds-base security update
389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.
Security Fix(es):
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.(CVE-2024-8445)
- Record
OESA-2025-1145- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1146
three-eight-nine-ds-base security update
389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.
Security Fix(es):
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.(CVE-2024-8445)
- Record
OESA-2025-1146- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2025-1147
three-eight-nine-ds-base security update
389-ds-base is an LDAPv3 compliant server which includes the LDAP server and command line utilities for server administration.
Security Fix(es):
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.(CVE-2024-8445)
- Record
OESA-2025-1147- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:7434
Red Hat Security Advisory: 389-ds-base security update
- Record
RHSA-2024:7434- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-8445
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
UBUNTU-CVE-2024-8445- CVSS 3.1
- 5.7 Medium
CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-110315 No score
CVE-2024-8445 affecting package 389-ds-base 3.1.1-12
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying userPassword using malformed input.
- Record
AZL-110315- Updated
- 2026-11-05
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
389-ds-baseAzure Linux:3 |
through 3.1.1-12 | None known |
389-ds-baseDebian:12 |
before 2.0.11-1 | 2.0.11-1 |
389-ds-baseDebian:13 |
before 2.0.11-1 | 2.0.11-1 |
389-ds-baseDebian:11 From an advisory covering 9 CVEs |
before 1.4.4.11-2+deb11u1, plus listed versions 1.4.4.11-2 |
1.4.4.11-2+deb11u1 |
three-eight-nine-ds-baseopenEuler:20.03-LTS-SP4 |
before 389-ds-base-1.4.3.36-8.oe2003sp4 | 389-ds-base-1.4.3.36-8.oe2003sp4 |
three-eight-nine-ds-baseopenEuler:22.03-LTS-SP3 |
before 389-ds-base-1.4.3.36-9.oe2203sp3 | 389-ds-base-1.4.3.36-9.oe2203sp3 |
three-eight-nine-ds-baseopenEuler:22.03-LTS-SP4 |
before 389-ds-base-1.4.3.36-9.oe2203sp4 | 389-ds-base-1.4.3.36-9.oe2203sp4 |
389-ds-baseRed Hat:rhel_els:7 |
before 0:1.3.11.1-7.el7_9 | 0:1.3.11.1-7.el7_9 |
389-ds-base-debuginfoRed Hat:rhel_els:7 |
before 0:1.3.11.1-7.el7_9 | 0:1.3.11.1-7.el7_9 |
389-ds-base-libsRed Hat:rhel_els:7 |
before 0:1.3.11.1-7.el7_9 | 0:1.3.11.1-7.el7_9 |
Show 10 moreShow less
| Package | Affected | Fixed |
|---|---|---|
389-ds-base-develRed Hat:rhel_els:7 |
before 0:1.3.11.1-7.el7_9 | 0:1.3.11.1-7.el7_9 |
389-ds-base-snmpRed Hat:rhel_els:7 |
before 0:1.3.11.1-7.el7_9 | 0:1.3.11.1-7.el7_9 |
389-ds-baseUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.3.3.12-1build11.3.3.13-11.3.4.5-21.3.4.8-11.3.4.8-3 Show 4 moreShow less1.3.4.8-3ubuntu11.3.4.8-41.3.4.9-11.3.4.9-1ubuntu0.1~esm1 |
None known |
389-ds-baseUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.3.7.5-11.3.7.5-1build11.3.7.5-1build21.3.7.9-11.3.7.10-11.3.7.10-1ubuntu11.3.7.10-1ubuntu1+esm1 |
None known |
389-ds-baseUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1.4.1.6-41.4.1.6-4build11.4.2.4-11.4.2.4-1build11.4.3.2-11.4.3.2-1build11.4.3.6-21.4.3.6-2ubuntu0.1~esm1 |
None known |
389-ds-baseUbuntu:22.04:LTS |
All versions, plus listed versions 1.4.4.11-2build11.4.4.11-2build21.4.4.17-12.0.11-22.0.14-12.0.15-12.0.15-1ubuntu2 |
None known |
389-ds-baseUbuntu:24.04:LTS |
All versions, plus listed versions 2.3.4+dfsg1-12.4.4+dfsg1-1ubuntu12.4.4+dfsg1-1ubuntu42.4.4+dfsg1-32.4.5+dfsg1-1 |
None known |
389-ds-baseUbuntu:25.10 |
All versions, plus listed versions 3.1.2+dfsg1-1 |
None known |
389-ds-baseUbuntu:26.10 |
All versions, plus listed versions 3.1.2+vendor1-23.1.2+vendor1-2build13.3.1-3 |
None known |
389-ds-baseUbuntu:26.04:LTS |
All versions, plus listed versions 3.1.2+dfsg1-13.1.2+vendor1-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | NVD, OSV | |
| facts | CVE List, EUVD, OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-8445 is a medium vulnerability (CVSS 5.7) in Red Hat Directory Server 11, published September 5, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. Fixed in 389-ds-base 2.0.11-1.
References
access.redhat.com/errata/RHSA-2024:7434
bugzilla.redhat.com/show_bug.cgi?id=2310110
lists.debian.org/debian-lts-announce/2025/01/msg00015.html
nvd.nist.gov/vuln/detail/CVE-2024-8445
github.com/advisories/GHSA-9q6m-vr5h-rqq5
Show 11 moreShow less
security-tracker.debian.org/tracker/CVE-2024-8445
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2025-1145
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_7434.json
cve.org/CVERecord?id=CVE-2024-8445
ubuntu.com/security/CVE-2024-8445