CVE-2019-10171 Denial of service in 389-ds-base

High 7.5 Published 2 Aug 2019 Updated 4 Aug 2024

An attacker can cause excessive CPU consumption leading to denial of service in the 389-ds-base LDAP server due to an incomplete security fix.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-10171?

CVE-2019-10171 is a high-severity denial of service vulnerability in Redhat Enterprise Linux Server Eus, published on 2 Aug 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

It was found that the fix for CVE-2018-14648 in 389-ds-base, versions 1.4.0.x before 1.4.0.17, was incorrectly applied in RHEL 7.5. An attacker would still be able to provoke excessive CPU consumption leading to a denial of service.

Weakness: CWE-770

Which versions are affected by CVE-2019-10171?

It affects 2 products.

Linux distribution packages (10)

`389-ds-base` Red Hat:rhel_eus:7.5::computenode	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-debuginfo` Red Hat:rhel_eus:7.5::computenode	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-devel` Red Hat:rhel_eus:7.5::computenode	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-libs` Red Hat:rhel_eus:7.5::computenode	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-snmp` Red Hat:rhel_eus:7.5::computenode	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base` Red Hat:rhel_eus:7.5::server	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-debuginfo` Red Hat:rhel_eus:7.5::server	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-devel` Red Hat:rhel_eus:7.5::server	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-libs` Red Hat:rhel_eus:7.5::server	All versions	`0:1.3.7.5-30.el7_5`
`389-ds-base-snmp` Red Hat:rhel_eus:7.5::server	All versions	`0:1.3.7.5-30.el7_5`

Products include Fedoraproject 389 Directory Server, Redhat Enterprise Linux Server Eus.

How do I fix CVE-2019-10171?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2019-10171 being exploited?

There is no known exploitation of CVE-2019-10171 in the wild and no public exploit code.

All Redhat Enterprise Linux Server Eus vulnerabilities

Sources

Also known as GHSA-9cc6-43cm-mf7x, RHSA-2019:1789.