Security fix for CVE-2024-8445
authorPierre Rogier <progier@redhat.com>
Mon, 23 Sep 2024 17:18:52 +0000 (19:18 +0200)
committerAndrej Shadura <andrewsh@debian.org>
Sun, 19 Jan 2025 12:30:31 +0000 (13:30 +0100)
commit52ed68979a8103468483c5ad13bc2142743b3209
treeca75a20d8bd5f4589e5a83ce056b94bb35481ec1
parent9ad2a57d213410f3a2ab89bd3f9b1dcdb767f235
Security fix for CVE-2024-8445

Description:
The fix for CVE-2024-2199 in 389-ds-base was insufficient to cover all
scenarios. In certain product versions, this issue may allow
an authenticated user to cause a server crash while modifying
`userPassword` using malformed input.

References:
- https://access.redhat.com/security/cve/CVE-2024-8445
- https://nvd.nist.gov/vuln/detail/cve-2024-8445
- https://bugzilla.redhat.com/show_bug.cgi?id=2310110
- https://nvd.nist.gov/vuln/detail/CVE-2024-2199
- https://access.redhat.com/security/cve/CVE-2024-2199
- https://bugzilla.redhat.com/show_bug.cgi?id=2267976

Origin: upstream, commit:1d3fddaac336f84e87ba399388f85734d79ebb95

Gbp-Pq: Name CVE-2024-8445.patch
ldap/servers/slapd/modify.c