Bug 2292104 (CVE-2024-5953)

Summary:	CVE-2024-5953 389-ds-base: Malformed userPassword hash may cause Denial of Service
Product:	[Other] Security Response	Reporter:	Patrick Del Bello <pdelbell>
Component:	vulnerability	Assignee:	Product Security <prodsec-ir-bot>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bsmejkal, idm-ds-dev-bugs, jachapma, musoni, progier, spichugi, ssidhaye, tbordaz, teagle, vashirov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2292109, 2292130, 2292131
Bug Blocks:	2292103

Description Patrick Del Bello 2024-06-13 04:22:32 UTC

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash or hang
while authenticating with an user having a malformed userPassword.
By default only the administrator may directly add hashed password that can trigger the issue. But if nsslapd-allow-hashed-passwords config parameter is turned on, any user can trigger the issue. 

The problem is triggered by adding a password to an user using the hashed format (with a hash value too long for the specified hash scheme)
Then later on when trying to authenticate on that user its triggers the buffer overflow

By default, only  administrators are allowed to add hashed passwords but there is a configuration parameter (nsslapd-allow-hashed-passwords) allowing any users to add hashed passwords and potentially trigger the DoS. 

This vulnerability affects versions: >= 1.3.7.2

Comment 1 Patrick Del Bello 2024-06-13 04:25:53 UTC

Created 389-ds-base tracking bugs for this issue:

Affects: fedora-all [bug 2292109]

Comment 6 Jamie Chapman 2024-07-17 15:41:17 UTC

Hi Patrick,

Can you create a clone of this ticket for a directory_server_12.4 z stream build.

Thank you

Comment 7 errata-xmlrpc 2024-07-18 15:17:56 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:4633 https://access.redhat.com/errata/RHSA-2024:4633

Comment 9 errata-xmlrpc 2024-08-05 00:59:25 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 12.4 for RHEL 9

Via RHSA-2024:4997 https://access.redhat.com/errata/RHSA-2024:4997

Comment 10 errata-xmlrpc 2024-08-12 01:26:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:5192 https://access.redhat.com/errata/RHSA-2024:5192

Comment 11 errata-xmlrpc 2024-08-21 11:53:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Extended Update Support

Via RHSA-2024:5690 https://access.redhat.com/errata/RHSA-2024:5690

Comment 12 errata-xmlrpc 2024-09-03 05:29:22 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7 Extended Lifecycle Support

Via RHSA-2024:6153 https://access.redhat.com/errata/RHSA-2024:6153

Comment 14 errata-xmlrpc 2024-09-11 00:07:11 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 11.9 for RHEL 8

Via RHSA-2024:6568 https://access.redhat.com/errata/RHSA-2024:6568

Comment 15 errata-xmlrpc 2024-09-11 00:44:33 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:6569 https://access.redhat.com/errata/RHSA-2024:6569

Comment 16 errata-xmlrpc 2024-09-11 06:35:53 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 11.7 for RHEL 8

Via RHSA-2024:6576 https://access.redhat.com/errata/RHSA-2024:6576

Comment 17 errata-xmlrpc 2024-10-01 15:51:49 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 12.2 EUS for RHEL 9

Via RHSA-2024:7458 https://access.redhat.com/errata/RHSA-2024:7458

Comment 20 errata-xmlrpc 2025-02-18 10:13:48 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 11.5 E4S for RHEL 8

Via RHSA-2025:1632 https://access.redhat.com/errata/RHSA-2025:1632