CVE-2022-2850
Medium
Description
A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Port389 389-ds-base
PublishedOct 14, 2022
First seenOct 14, 2022
Weakness typeCWE-476NULL pointer dereference
How to fix
Sources list no fixed version or patch link for this vulnerability.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| port389 389-ds-base | 2.0.0 ≤ v ≤ 2.4.1 | — |
| redhat directory_server | 11.0, 12.0 | — |
| redhat enterprise_linux | 6.0, 7.0, 8.0, 9.0 | — |
| fedoraproject fedora | 35, 36 | — |
| debian debian_linux | 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.