CVE-2024-8445: 
Linux Debian vulnerability analysis and mitigation

CVE-2024-8445 is a security vulnerability affecting the 389 Directory Server (389-ds-base) software. The vulnerability stems from an incomplete fix for a previous issue (CVE-2024-2199), where an authenticated user can cause a server crash by modifying the userPassword attribute using malformed input (NVD, Red Hat Bugzilla).

The vulnerability has been assigned a CVSS v3.1 base score of 5.7 (Medium) with the following vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-20 (Improper Input Validation), indicating that the issue stems from insufficient validation of user-supplied input when processing password modifications (NVD).

When exploited, this vulnerability can lead to a denial of service condition by causing the server to crash. The impact is limited to availability, with no direct effect on confidentiality or integrity of the system (Red Hat Errata).

Red Hat has released security updates to address this vulnerability in Red Hat Enterprise Linux 7 Extended Life Cycle Support through RHSA-2024:7434. Users are advised to update to the patched version 389-ds-base-1.3.11.1-7.el7_9 (Red Hat Errata).