CVE-2024-6237: directory server — Fix

Description

A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service.

Is your site exposed to CVE-2024-6237?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

6.5

MEDIUM

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-230 CWE-230

Affected Products

Vendor	Product	Versions
redhat	directory_server	All
redhat	389_directory_server	All
redhat	enterprise_linux	All

References

Advisories & Patches

https://access.redhat.com/security/cve/CVE-2024-6237 https://access.redhat.com/security/cve/CVE-2024-6237

Other References

https://access.redhat.com/errata/RHSA-2024:4997 https://access.redhat.com/errata/RHSA-2024:5192 https://bugzilla.redhat.com/show_bug.cgi?id=2293579 https://github.com/389ds/389-ds-base/issues/5989 https://bugzilla.redhat.com/show_bug.cgi?id=2293579 https://github.com/389ds/389-ds-base/issues/5989

Frequently Asked Questions

What is CVE-2024-6237? +

A flaw was found in the 389 Directory Server. This flaw allows an unauthenticated user to cause a systematic server crash while sending a specific extended search request, leading to a denial of service. It has a CVSS v3.1 base score of 6.5 (MEDIUM).

How severe is CVE-2024-6237? +

CVE-2024-6237 has a CVSS v3.1 score of 6.5 out of 10, rated MEDIUM. This is a medium-severity vulnerability that should be remediated as part of regular maintenance.

What products are affected by CVE-2024-6237? +

CVE-2024-6237 affects products from redhat, specifically: 389_directory_server, directory_server, enterprise_linux. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-6237? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-19395

In Qt for MCUs, a Text element that displays styled text halts the device if an <img> tag in the …

CVE-2024-11024 9.8

The AppPresser – Mobile App Framework plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions …

CVE-2024-10508 9.8

The RegistrationMagic – User Registration Plugin with Custom Registration Forms plugin for WordPress is vulnerable to privilege escalation via account …

CVE-2024-0048 7.8

In Session of AccountManagerService.java, there is a possible method to retain foreground service privileges due to incorrect handling of null …

CVE-2024-9781 7.8

AppleTalk and RELOAD Framing dissector crash in Wireshark 4.4.0 and 4.2.0 to 4.2.7 allows denial of service via packet injection …

CVE-2024-0208 7.8

GVCP dissector crash in Wireshark 4.2.0, 4.0.0 to 4.0.11, and 3.6.0 to 3.6.19 allows denial of service via packet injection …

CVE-2024-6237