7.5

CVE-2018-14624: debian debian_linux Improper Input Validation

CVSS: 7.5v3.0HighModified
AliasesUBUNTU-CVE-2018-14624DEBIAN-CVE-2018-14624DLA-1526-1
Published 06-09-2018Last modified 05-08-2024
Open JSON

Vulnerability summary

CVE-2018-14624 is a high (CVSS 7.5) Improper Input Validation vulnerability in debian debian_linux. EPSS estimates a 2.38% chance of exploitation in the next 30 days, higher than 83.6% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
40/100
0100
Medium · default modelHow is this calculated?
CVSS score
7.5/10
010
High · v3.0 (CVE.org)
EPSS score
2.38%
0%100%
Low · -0.07 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 6 · Related 4
MGASA-2018-0404OPENSUSE-SU-2019:1397-1OPENSUSE-SU-2024:10593-1RHSA-2018:2757SUSE-SU-2019:1207-1SUSE-SU-2019:1207-2

Timeline

  1. 06-09-2018
    PublishedVulnerability first disclosed.
  2. 05-08-2024
    Last modifiedVulnerability information updated.

Description

A vulnerability was discovered in 389-ds-base through versions 1.3.7.10, 1.3.8.8 and 1.4.0.16. The lock controlling the error log was not correctly used when re-opening the log file in log__error_emergency(). An attacker could send a flood of modifications to a very large DN, which would cause slapd to crash.

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

2.38%

Chance of exploitation in the next 30 days

Percentile

84%

Versus all other CVEs

30-day change

-0.07 pp

From 2.45% on 18-09-2026

18-09-202618-10-2026
EPSS score
2.38%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (pagure.io)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat6 products
Debian2 products
  • 389-ds-base< 1.4.0.18-1 | < 1.3.3.5-4+deb8u3
  • debian_linuxEOL8.0
[unknown]1 product
  • 389-ds-base≥ unspecified, ≤ 1.4.0.16 | ≥ unspecified, ≤ 1.3.8.8 | ≥ unspecified, ≤ 1.3.7.10
Fedoraproject1 product
Ubuntu1 product
  • 389-ds-baseAll versions (No fix recorded)

5 vendors · 11 products

References

8 links