{"id":"CVE-2017-2591","aliases":["DEBIAN-CVE-2017-2591","EUVD-2017-11769","GHSA-cmhq-25mx-42j8","MGASA-2017-0028","UBUNTU-CVE-2017-2591"],"status":"published","title":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the...","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","severity":{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.0281,"percentile":0.86607,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-122","CWE-125"],"published":"2017-01-27T20:30:52Z","modified":"2026-09-01T20:03:47Z","fixes":[{"ecosystem":"Debian:12","package":"389-ds-base","fixed_in":["1.3.5.15-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"389-ds-base","fixed_in":["1.3.5.15-2"],"sources":["osv"]},{"ecosystem":"Mageia:5","package":"389-ds-base","fixed_in":["1.3.4.14-1.1.mga5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5.15-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5.15-2"}]}]},{"source":"osv","ecosystem":"Mageia:5","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.4.14-1.1.mga5"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3.12-1build1","1.3.3.13-1","1.3.4.5-2","1.3.4.8-1","1.3.4.8-3","1.3.4.8-3ubuntu1","1.3.4.8-4","1.3.4.9-1","1.3.4.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+dfsg1-1","3.1.2+vendor1-2"]}],"products":[{"vendor":"fedoraproject","product":"389_directory_server"},{"vendor":"redhat","product":"enterprise_linux"},{"vendor":"unspecified","product":"389-ds-base"}],"references":[{"url":"https://pagure.io/389-ds-base/issue/48986","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2591","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","report"]},{"url":"http://www.securityfocus.com/bid/95670","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-2591"},{"url":"https://github.com/advisories/GHSA-cmhq-25mx-42j8"},{"url":"https://security-tracker.debian.org/tracker/CVE-2017-2591","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2017-0028.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=20138","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2017/01/18/5","tags":["web"]},{"url":"https://fedorahosted.org/389/ticket/48986","tags":["web","report"]},{"url":"https://ubuntu.com/security/CVE-2017-2591","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2017-2591","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2017-2591","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","status":"published","published":"2018-04-30T12:00:00Z","modified":"2024-08-05T14:02:06.992Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:33:15.543086Z"}],"euvd":[{"id":"EUVD-2017-11769","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","status":"published","published":"2018-04-30T12:00:00Z","modified":"2024-08-05T14:02:06Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"}],"updated_at":"2026-11-03T02:39:20.499267Z"}],"ghsa":[{"id":"GHSA-cmhq-25mx-42j8","title":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the...","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","status":"published","published":"2022-05-13T01:36:55Z","modified":"2023-02-01T05:09:03Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:50:54.417127Z"}],"nvd":[{"id":"CVE-2017-2591","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","status":"published","published":"2018-04-30T12:29:00.22Z","modified":"2026-06-17T01:16:27.81Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-122","CWE-125"],"updated_at":"2026-11-02T14:04:17.638656Z"}],"osv":[{"id":"CVE-2017-2591","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","status":"published","published":"2018-04-30T12:29:00.22Z","modified":"2026-04-16T06:24:39.157611458Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:05.486486Z"},{"id":"DEBIAN-CVE-2017-2591","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","status":"published","published":"2018-04-30T12:29:00.22Z","modified":"2026-09-01T20:03:47.688642309Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.100767Z"},{"id":"UBUNTU-CVE-2017-2591","description":"389-ds-base before version 1.3.6 is vulnerable to an improperly NULL terminated array in the uniqueness_entry_to_config() function in the \"attribute uniqueness\" plugin of 389 Directory Server. An authenticated, or possibly unauthenticated, attacker could use this flaw to force an out-of-bound heap memory read, possibly triggering a crash of the LDAP service.","status":"published","published":"2018-04-30T12:29:00Z","modified":"2026-05-20T16:03:21.520166132Z","cvss":[{"version":"3.0","score":3.7,"vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"low"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:14.977781Z"},{"id":"MGASA-2017-0028","title":"Updated 389-ds-base packages fix security vulnerability","description":"The \"attribute uniqueness\" plugin did not properly NULL-terminate an\narray when building up its configuration if a so called 'old-style'\nconfiguration was being used. An attacker, authenticated, but possibly\nalso unauthenticated, could possibly force the plugin to read beyond\nallocated memory and trigger a segfault. The crash could also possibly\nbe triggered accidentally (CVE-2017-2591).\n","status":"published","published":"2017-01-27T20:30:52Z","modified":"2026-04-16T06:25:34.617541549Z","updated_at":"2026-11-02T15:49:40.103088Z"}]}}