ALAS-2025-2798

Amazon Linux 2 Security Advisory: ALAS-2025-2798
Advisory Release Date: 2025-03-13 01:30 Pacific
Advisory Updated Date: 2025-03-25 16:12 Pacific
Severity: Medium
Issue Overview:

A denial of service vulnerability was found in 389-ds-base ldap server. This issue may allow an authenticated user to cause a server crash while modifying `userPassword` using malformed input. (CVE-2024-2199)

A flaw was found in 389-ds-base. A specially-crafted LDAP query can potentially cause a failure on the directory server, leading to a denial of service (CVE-2024-3657)

A denial of service vulnerability was found in the 389-ds-base LDAP server. This issue may allow an authenticated user to cause a server denial of service while attempting to log in with a user with a malformed hash in their password. (CVE-2024-5953)

The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all scenarios. In certain product versions, an authenticated user may cause a server crash while modifying `userPassword` using malformed input. (CVE-2024-8445)


Affected Packages:

389-ds-base


Note:

This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.


Issue Correction:
Run yum update 389-ds-base to update your system.

New Packages:
aarch64:
    389-ds-base-1.3.10.2-17.amzn2.0.2.aarch64
    389-ds-base-libs-1.3.10.2-17.amzn2.0.2.aarch64
    389-ds-base-devel-1.3.10.2-17.amzn2.0.2.aarch64
    389-ds-base-snmp-1.3.10.2-17.amzn2.0.2.aarch64
    389-ds-base-debuginfo-1.3.10.2-17.amzn2.0.2.aarch64

i686:
    389-ds-base-1.3.10.2-17.amzn2.0.2.i686
    389-ds-base-libs-1.3.10.2-17.amzn2.0.2.i686
    389-ds-base-devel-1.3.10.2-17.amzn2.0.2.i686
    389-ds-base-snmp-1.3.10.2-17.amzn2.0.2.i686
    389-ds-base-debuginfo-1.3.10.2-17.amzn2.0.2.i686

src:
    389-ds-base-1.3.10.2-17.amzn2.0.2.src

x86_64:
    389-ds-base-1.3.10.2-17.amzn2.0.2.x86_64
    389-ds-base-libs-1.3.10.2-17.amzn2.0.2.x86_64
    389-ds-base-devel-1.3.10.2-17.amzn2.0.2.x86_64
    389-ds-base-snmp-1.3.10.2-17.amzn2.0.2.x86_64
    389-ds-base-debuginfo-1.3.10.2-17.amzn2.0.2.x86_64

Additional References

Red Hat: CVE-2024-2199, CVE-2024-3657, CVE-2024-5953, CVE-2024-8445

Mitre: CVE-2024-2199, CVE-2024-3657, CVE-2024-5953, CVE-2024-8445