Race condition in nss_ldap, when used in applications that are linked against the pthread library and fork after a call to nss_ldap, might send user data to the wrong process because of improper handling of the LDAP connection. NOTE: this issue was originally reported for Dovecot with the wrong mailboxes being returned, but other applications might also be affected.
CVSS Details
- CVSS 3.1 Base Score: 5.9
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade libnss-ldap | Jul 30, 2024 | Nov 13, 2007 |
| Gentoo Linux | — | Upgrade sys-auth/nss_ldap. | Oct 30, 2017 | Nov 13, 2007 |
| Oracle_linux | — | Upgrade nss_ldap | Oct 16, 2024 | Nov 13, 2007 |
| Suse | — | Upgrade nss_ldapUpgrade nss_ldap-x86Upgrade nss_ldap-32bitUpgrade nss_ldap-64bitUpgrade suse-release | Feb 17, 2015 | Nov 13, 2007 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub