6.5

CVE-2022-2850: debian debian_linux NULL Pointer Dereference

CVSS: 6.5v3.1MediumModified
AliasesMGASA-2022-0413SUSE-SU-2022:3029-1SUSE-SU-2022:3286-1
Published 14-10-2022Last modified 03-11-2025
Open JSON

Vulnerability summary

CVE-2022-2850 is a medium (CVSS 6.5) NULL Pointer Dereference vulnerability in debian debian_linux. EPSS estimates a 1.57% chance of exploitation in the next 30 days, higher than 74.9% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
36/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
1.57%
0%100%
Low · +0.26 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits2reference

Advisory lineage

Upstream 0 · Downstream 4
DLA-3399-1DLA-4021-1RHSA-2022:8162RHSA-2022:8976

Timeline

  1. 14-10-2022
    PublishedVulnerability first disclosed.
  2. 03-11-2025
    Last modifiedVulnerability information updated.

Description

A flaw was found In 389-ds-base. When the Content Synchronization plugin is enabled, an authenticated user can reach a NULL pointer dereference using a specially crafted query. This flaw allows an authenticated attacker to cause a denial of service. This CVE is assigned against an incomplete fix of CVE-2021-3514.

CVSS metrics

5 scores · 5 sources · 1 version

EPSS trend

Probability

1.57%

Chance of exploitation in the next 30 days

Percentile

75%

Versus all other CVEs

30-day change

+0.26 pp

From 1.30% on 19-09-2026

19-09-202619-10-2026
EPSS score
1.57%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

2 found
  • referenceUnverified

    Exploit Reference (bugzilla.redhat.com)

    Maturity: unknown

  • referenceUnverified

    Exploit Reference (access.redhat.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Redhat14 products
  • directory_server11.0 | 12.0
  • enterprise_linuxEOL6.0 | 7.0 | 8.0 | 9.0
  • 389-ds-base< 0:1.3.10.2-17.el7_9 | < 0:1.4.3.28-8.module+el8.6.0+16880+945f9b53 | < 0:1.4.3.16-24.module+el8.4.0+17207+46c15e64 | < 0:1.4.3.29-7.module+el8dsrv+17334+74991258 | < 0:2.0.18-3.module+el9dsrv+17947+6e05a0b8
  • 389-ds-base-debuginfo< 0:1.3.10.2-17.el7_9 | < 0:1.4.3.28-8.module+el8.6.0+16880+945f9b53 | < 0:1.4.3.16-24.module+el8.4.0+17207+46c15e64 | < 0:1.4.3.29-7.module+el8dsrv+17334+74991258 | < 0:2.0.18-3.module+el9dsrv+17947+6e05a0b8
  • 389-ds-base-debugsource< 0:1.4.3.28-8.module+el8.6.0+16880+945f9b53 | < 0:1.4.3.16-24.module+el8.4.0+17207+46c15e64 | < 0:1.4.3.29-7.module+el8dsrv+17334+74991258 | < 0:2.0.18-3.module+el9dsrv+17947+6e05a0b8
Debian2 products
Opensuse2 products
  • 389-ds&distro=openSUSE Leap 15.3< 1.4.4.19~git46.c900a28c8-150300.3.22.1
  • 389-ds&distro=openSUSE Leap 15.4< 2.0.16~git20.219f047ae-150400.3.10.1
Suse2 products
  • 389-ds&distro=SUSE Linux Enterprise Module for Server Applications 15 SP3< 1.4.4.19~git46.c900a28c8-150300.3.22.1
  • 389-ds&distro=SUSE Linux Enterprise Module for Server Applications 15 SP4< 2.0.16~git20.219f047ae-150400.3.10.1
Fedoraproject1 product
Mageia1 product
  • 389-ds-base< 1.4.0.26-8.6.mga8
Port3891 product
Ubuntu1 product
  • 389-ds-baseAll versions (No fix recorded)

8 vendors · 24 products

References

32 links
Show all 32 references