CVE-2019-3883
Last modified
CVE-2019-3883 is a high-severity vulnerability rated 7.5/10 on the CVSS scale. In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. EPSS estimates a 8.43% chance of exploitation in the next 30 days.
Description
In 389-ds-base up to version 1.4.1.2, requests are handled by workers threads. Each sockets will be waited by the worker for at most 'ioblocktimeout' seconds. However this timeout applies only for un-encrypted requests. Connections using SSL/TLS are not taking this timeout into account during reads, and may hang longer.An unauthenticated attacker could repeatedly create hanging LDAP requests to hang all the workers, resulting in a Denial of Service.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Fedoraproject | 389 Directory Server | <= 1.4.1.2 |
| Debian | Debian Linux | 8.0 |
| Redhat | Enterprise Linux | 6.0 |
References
- https://access.redhat.com/errata/RHSA-2019:1896Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3401Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00008.htmlMailing List, Third Party Advisory
- https://pagure.io/389-ds-base/issue/50329Issue Tracking, Third Party Advisory
- https://pagure.io/389-ds-base/pull-request/50331Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:1896Third Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3401Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3883Issue Tracking, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2019/05/msg00008.htmlMailing List, Third Party Advisory
- https://pagure.io/389-ds-base/issue/50329Issue Tracking, Third Party Advisory
- https://pagure.io/389-ds-base/pull-request/50331Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-3883?
How severe is CVE-2019-3883?
How do I fix CVE-2019-3883?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-3877A vulnerability was found in mod_auth_mellon before v0.14.2.…5.8
- CVE-2019-3878A vulnerability was found in mod_auth_mellon before v0.14.2.…8.1
- CVE-2019-3879It was discovered that in the ovirt's REST API before versio…8.1
- CVE-2019-3880A flaw was found in the way samba implemented an RPC endpoin…5.4
- CVE-2019-3881Bundler prior to 2.1.0 uses a predictable path in /tmp/, cre…7.8
- CVE-2019-3882A flaw was found in the Linux kernel's vfio interface implem…5.5
- CVE-2019-3884A vulnerability exists in the garbage collection mechanism o…5.4
- CVE-2019-3885A use-after-free flaw was found in pacemaker up to and inclu…3.3
- CVE-2019-3886An incorrect permissions check was discovered in libvirt 4.8…5.4
- CVE-2019-3887A flaw was found in the way KVM hypervisor handled x2APIC Ma…5.6
- CVE-2019-3888A vulnerability was found in Undertow web server before 2.0.…9.8
- CVE-2019-3889A reflected XSS vulnerability exists in authorization flow o…5.4
Are you affected by CVE-2019-3883?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST