attack vector is network; attack complexity is low; privileges required is none; user interaction is none; scope is unchanged; confidentiality impact is none; integrity impact is none; availability impact is high.
Affected products
see table below
Classified as
CWE-770 (Allocation of Resources Without Limits or Throttling)
Affected Products, Subsystems & Sectors
Vendor
Product
Affected Versions
Patch Status
Red Hat
Enterprise Linux
Red Hat
Red Hat Enterprise Linux 10
Red Hat
Red Hat Enterprise Linux 10.0 Extended Update Support
Red Hat
Red Hat Enterprise Linux 8
Red Hat
Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
Red Hat
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Red Hat
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Red Hat
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Red Hat
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9
Red Hat
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Red Hat
Red Hat Enterprise Linux 9.6 Extended Update Support
Red Hat
Red Hat Enterprise Linux 7 Extended Lifecycle Support
Red Hat
Red Hat Directory Server 12
Red Hat
Red Hat Directory Server 13
Red Hat
directory_server
Red Hat
389_directory_server
Red Hat
Red Hat Directory Server 11.5 E4S for RHEL 8
Red Hat
Red Hat Directory Server 11.7 E4S for RHEL 8
Red Hat
Red Hat Directory Server 11.9 for RHEL 8
Red Hat
Red Hat Directory Server 12.2 E4S for RHEL 9
Red Hat
Red Hat Directory Server 12.4 E4S for RHEL 9
Red Hat
Red Hat Directory Server 13.2
Subsystems
OT Supporting Infrastructure
Sectors
All Sectors
What to Know
A flaw was found in 389-ds-base. The get_ldapmessage_controls_ext() function in the LDAP server does not enforce an upper bound on the number of controls per LDAP message. A remote, unauthenticated attacker can send a specially crafted LDAP request containing hundreds of thousands of minimal controls within the default maximum BER message size (2 MB), causing excessive CPU consumption and heap allocation on the server. Under concurrent exploitation, this leads to significant latency degradation, worker thread starvation, or out-of-memory termination, resulting in a denial of service. (NVD)
What to Do
Monitor Red Hat's web page for any future patch releases. See vendor advisory link below.