CVE-2017-2668: Fedoraproject 389 Directory Server

Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days.

389-ds-base before versions 1.3.5.17 and 1.3.6.10 is vulnerable to an invalid pointer dereference in the way LDAP bind requests are handled. A remote unauthenticated attacker could use this flaw to make ns-slapd crash via a specially crafted LDAP bind request, resulting in denial of service.

Affected products

• Fedoraproject 389 Directory Server: from 1.3.5.0, before 1.3.5.17 (fixed in 1.3.5.17); from 1.3.6.0, before 1.3.6.10 (fixed in 1.3.6.10)
• Red Hat Enterprise Linux Desktop: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Server: version 6.0 only; version 7.0 only
• Red Hat Enterprise Linux Workstation: version 6.0 only; version 7.0 only

Published 2018-06-22. Last modified 2026-06-17.