← Back

CVE-2022-2850

nvd nist
Published: Oct 14, 2022Modified: Jun 17, 2026

JSON object

Loading...
6.5
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Exploitability: 2.8 / Impact: 3.6
Source: NVD

Description

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

Affected (10)

Show all products
Redhat: Directory Server, Enterprise Linux · Fedoraproject: Fedora · Port389: 389 Ds Base · Debian: Debian Linux
Redhat
2 products
Directory Server
Enterprise Linux
Fedoraproject
1 product
Fedora
Port389
1 product
389 Ds Base
Debian
1 product
Debian Linux
Configuration A
6 vulnerable
Vulnerable SoftwareAffected Versions
Redhat
Directory Server
Version 11.0
Directory Server
Version 12.0
Redhat
Enterprise Linux
Version 6.0
Enterprise Linux
Version 7.0
Enterprise Linux
Version 8.0
Enterprise Linux
Version 9.0
Configuration B
2 vulnerable
Vulnerable SoftwareAffected Versions
Fedoraproject
Fedora
Version 35
Fedora
Version 36
Configuration C
1 vulnerable
Vulnerable SoftwareAffected Versions
389 Ds Base
From 2.0.0 to 2.4.1
Configuration D
1 vulnerable
Vulnerable SoftwareAffected Versions
Debian Linux
Version 10.0

Related CWEs

CWE-476
NULL Pointer Dereference
The product dereferences a pointer that it expects to be valid but is NULL.

References (7)

Source: secalert@redhat.com
ExploitVendor Advisory
Source: secalert@redhat.com
ExploitIssue TrackingVendor Advisory
Source: secalert@redhat.com
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
ExploitIssue TrackingVendor Advisory
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing ListThird Party Advisory
Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.