Bug 2353071 (CVE-2025-2487)

Summary:	CVE-2025-2487 389-ds-base: null pointer dereference leads to denial of service
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bsmejkal, jachapma, progier, spichugi, ssidhaye, tbordaz, teagle, tmihinto, vashirov
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the 389-ds-base LDAP Server. This issue occurs when issuing a Modify DN LDAP operation through the ldap protocol, when the function return value is not tested and a NULL pointer is dereferenced. If a privileged user performs a ldap MODDN operation after a failed operation, it could lead to a Denial of Service (DoS) or system crash.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2025-03-18 02:27:46 UTC

A flaw was found in 389-ds-base. The problem occurs when issuing a Modify DN LDAP operation through the ldap
protocol (using a TCP-IP or Unix socket as defined in the LDAP RFC
https://datatracker.ietf.org/doc/html/rfc4511#section-4.9)
If it moves an ldap entry in the DIT at the same time that a failing
operation impacts its parent entry.

Comment 2 errata-xmlrpc 2025-04-08 00:13:30 UTC

This issue has been addressed in the following products:

  Red Hat Directory Server 12.4 EUS for RHEL 9

Via RHSA-2025:3670 https://access.redhat.com/errata/RHSA-2025:3670

Comment 3 errata-xmlrpc 2025-04-08 01:04:38 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2025:3663 https://access.redhat.com/errata/RHSA-2025:3663

Comment 4 errata-xmlrpc 2025-05-06 01:50:05 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:4491 https://access.redhat.com/errata/RHSA-2025:4491

Comment 5 errata-xmlrpc 2025-05-13 11:52:35 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:7395 https://access.redhat.com/errata/RHSA-2025:7395