{"id":"CVE-2018-1089","aliases":["DEBIAN-CVE-2018-1089","DLA-1428-1","EUVD-2018-11739","GHSA-4xv3-w7vq-3g6v","MGASA-2018-0245","RHSA-2018:1364","RHSA-2018:1380","SUSE-SU-2019:2155-1","UBUNTU-CVE-2018-1089","openSUSE-SU-2024:10593-1"],"status":"published","title":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search...","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-07","score":0.04013,"percentile":0.90625,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-119","CWE-122"],"published":"2018-05-09T15:00:00Z","modified":"2026-10-23T18:04:46Z","fixes":[{"ecosystem":"Debian:12","package":"389-ds-base","fixed_in":["1.3.8.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"389-ds-base","fixed_in":["1.3.8.2-1"],"sources":["osv"]},{"ecosystem":"Mageia:6","package":"389-ds-base","fixed_in":["1.3.5.17-1.5.mga6"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-debuginfo","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-libs","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-devel","fixed_in":["0:1.2.11.15-95.el6_9"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-devel","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-libs","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-snmp","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-devel","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-libs","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-snmp","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-libs","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-devel","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-snmp","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-debuginfo","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-libs","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-devel","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]},{"ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-snmp","fixed_in":["0:1.3.7.5-21.el7_5"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.8.2-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3.5-4+deb8u1"}]}],"versions":["1.3.3.5-4"],"bundled":5},{"source":"osv","ecosystem":"Mageia:6","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.5.17-1.5.mga6"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::client","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::computenode","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::server","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:6::workstation","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.2.11.15-95.el6_9"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::client","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::computenode","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"389-ds-base-snmp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.3.7.5-21.el7_5"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.26~git0.8a2d3de6f-4.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.4.0.26~git0.8a2d3de6f-4.14.1"}]}],"bundled":8},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.3.12-1build1","1.3.3.13-1","1.3.4.5-2","1.3.4.8-1","1.3.4.8-3","1.3.4.8-3ubuntu1","1.3.4.8-4","1.3.4.9-1","1.3.4.9-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.7.5-1","1.3.7.5-1build1","1.3.7.5-1build2","1.3.7.9-1","1.3.7.10-1","1.3.7.10-1ubuntu1","1.3.7.10-1ubuntu1+esm1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"389-ds-base","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.1.2+dfsg1-1","3.1.2+vendor1-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"389-ds","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.10~git0.21dd2802c-1.1"}]}],"bundled":11}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"389_directory_server"},{"vendor":"redhat","product":"enterprise_linux_desktop"},{"vendor":"redhat","product":"enterprise_linux_server"},{"vendor":"redhat","product":"enterprise_linux_workstation"},{"vendor":"unspecified","product":"389-ds-base"}],"references":[{"url":"http://www.securityfocus.com/bid/104137","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1364","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-1089","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","fix","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2018:1380","tags":["vendor-advisory","x_refsource_REDHAT","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2018/07/msg00018.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1089","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-4xv3-w7vq-3g6v"},{"url":"https://security-tracker.debian.org/tracker/CVE-2018-1089","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2018-0245.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=23005","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559802","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1364.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2018-1089","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2018-1089","tags":["advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1554720","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559464","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559760","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1559764","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1563079","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1380.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192155-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1083689","tags":["report"]},{"url":"https://bugzilla.suse.com/1092187","tags":["report"]},{"url":"https://bugzilla.suse.com/1099465","tags":["report"]},{"url":"https://bugzilla.suse.com/1105606","tags":["report"]},{"url":"https://bugzilla.suse.com/1108674","tags":["report"]},{"url":"https://bugzilla.suse.com/1109609","tags":["report"]},{"url":"https://bugzilla.suse.com/1120189","tags":["report"]},{"url":"https://bugzilla.suse.com/1132385","tags":["report"]},{"url":"https://bugzilla.suse.com/1144797","tags":["report"]},{"url":"https://bugzilla.suse.com/991201","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1054","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10871","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-1089","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10935","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14638","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14648","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-3883","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2018-1089","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2018/05/07/2","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4992","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-10850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2018-14624","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14824","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2018-1089","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","status":"published","published":"2018-05-09T15:00:00Z","modified":"2024-08-05T03:51:48.5Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-122"],"updated_at":"2026-11-02T14:35:08.701206Z"}],"euvd":[{"id":"EUVD-2018-11739","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","status":"published","published":"2018-05-09T15:00:00Z","modified":"2024-08-05T03:51:48Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T02:40:16.874515Z"}],"ghsa":[{"id":"GHSA-4xv3-w7vq-3g6v","title":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search...","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","status":"published","published":"2022-05-13T01:33:33Z","modified":"2023-02-01T05:08:20Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-119"],"updated_at":"2026-11-02T14:50:44.535607Z"}],"nvd":[{"id":"CVE-2018-1089","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","status":"published","published":"2018-05-09T15:29:00.207Z","modified":"2026-06-17T01:50:27.35Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-122","CWE-119"],"updated_at":"2026-11-02T14:04:26.098615Z"}],"osv":[{"id":"CVE-2018-1089","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","status":"published","published":"2018-05-09T15:29:00.207Z","modified":"2026-04-16T06:19:16.167743107Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:07.641418Z"},{"id":"DEBIAN-CVE-2018-1089","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","status":"published","published":"2018-05-09T15:29:00.207Z","modified":"2026-10-23T18:04:46.531136535Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:29.988046Z"},{"id":"RHSA-2018:1364","title":"Red Hat Security Advisory: 389-ds-base security update","status":"published","published":"2024-09-16T01:03:52Z","modified":"2026-07-01T10:03:43Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"RHSA-2018:1380","title":"Red Hat Security Advisory: 389-ds-base security and bug fix update","status":"published","published":"2024-09-16T01:03:46Z","modified":"2026-07-01T10:03:44Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:04.822845Z"},{"id":"UBUNTU-CVE-2018-1089","description":"389-ds-base before versions 1.4.0.9, 1.3.8.1, 1.3.6.15 did not properly handle long search filters with characters needing escapes, possibly leading to buffer overflows. A remote, unauthenticated attacker could potentially use this flaw to make ns-slapd crash via a specially crafted LDAP request, thus resulting in denial of service.","status":"published","published":"2018-05-09T15:29:00Z","modified":"2026-05-20T16:03:22.309009056Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:16.544091Z"},{"id":"DLA-1428-1","title":"389-ds-base - security update","status":"published","published":"2018-07-15T00:00:00Z","modified":"2026-03-09T01:01:52.842734Z","updated_at":"2026-11-02T15:46:09.336894Z"},{"id":"MGASA-2018-0245","title":"Updated 389-ds-base packages fix security vulnerability","description":"389-ds-base did not properly handle characters needed to be escaped in\nits query filter. This could result in buffer overflows, from the heap\nor the stack, on larger filters.  An unauthenticated attacker could send\na specially crafted LDAP request and crash the server (CVE-2018-1089).\n","status":"published","published":"2018-05-16T08:24:56Z","modified":"2026-04-16T06:22:43.766105933Z","updated_at":"2026-11-02T15:49:40.442238Z"},{"id":"openSUSE-SU-2024:10593-1","title":"389-ds-2.0.10~git0.21dd2802c-1.1 on GA media","description":"These are all security issues fixed in the 389-ds-2.0.10~git0.21dd2802c-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:27:27.422184Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:2155-1","title":"Security update for 389-ds","description":"This update for 389-ds to version 1.4.0.26 fixes the following issues:\n\nSecurity issues fixed:\n\n- CVE-2016-5416: Fixed an information disclosure where a anonymous user could read the default ACI (bsc#991201).\n- CVE-2018-1054: Fixed a denial of service via search filters in SetUnicodeStringFromUTF_8() (bsc#1083689).\n- CVE-2018-1089: Fixed a buffer overflow via large filter value (bsc#1092187).\n- CVE-2018-10871: Fixed an information disclosure in certain plugins leading to the disclosure of plaintext password to an privileged attackers (bsc#1099465).\n- CVE-2018-14638: Fixed a denial of service through a crash in delete_passwdPolicy () (bsc#1108674).\n- CVE-2018-14648: Fixed a denial of service caused by malformed values in search queries (bsc#1109609).\n- CVE-2018-10935: Fixed a denial of service related to ldapsearch with server side sort (bsc#1105606).\n- CVE-2019-3883: Fixed a denial of service caused by hanging LDAP requests over TLS (bsc#1132385).\n","status":"published","published":"2019-08-15T15:51:09Z","modified":"2026-02-04T04:35:43.300712Z","updated_at":"2026-11-02T15:53:46.44301Z"}]}}