CVE-2024-3657 – A vulnerability in 389-ds-base allows attackers... (How to Fix)

Q: What is the severity of CVE-2024-3657?

CVE-2024-3657 has a CVSS score of 7.5 (HIGH). A vulnerability in 389-ds-base allows attackers to cause denial of service through specially crafted LDAP queries. This affects systems running vulnerable versions of the 389 Directory Server, potentially disrupting directory services and authentication.

📋 TL;DR

A vulnerability in 389-ds-base allows attackers to cause denial of service through specially crafted LDAP queries. This affects systems running vulnerable versions of the 389 Directory Server, potentially disrupting directory services and authentication.

💻 Affected Systems

Products:

389-ds-base
Red Hat Directory Server

Versions: Specific versions listed in Red Hat advisories (check references)

Operating Systems: RHEL 7, RHEL 8, RHEL 9

Default Config Vulnerable: ⚠️ Yes

Notes: Affects default installations; any system with LDAP query access is vulnerable.

⚠️ Manual Verification Required

This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.

Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).

🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.

Recommended Actions:

Review the CVE details at NVD
Check vendor security advisories for your specific version
Test if the vulnerability is exploitable in your environment
Consider updating to the latest version as a precaution

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete directory server crash leading to authentication failures, service disruption, and potential cascading failures in dependent systems.

🟠

Likely Case

Temporary service interruption requiring server restart, impacting LDAP-dependent applications and user authentication.

🟢

If Mitigated

Minimal impact with proper network segmentation and query filtering in place.

🌐 Internet-Facing: MEDIUM

🏢 Internal Only: HIGH

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW

Requires LDAP query access; authenticated users or network access to LDAP port needed.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check specific Red Hat advisories for version numbers

Vendor Advisory: https://access.redhat.com/errata/RHSA-2024:3591

Restart Required: Yes

Instructions:

1. Update 389-ds-base package using yum update 2. Restart directory server service 3. Verify service is running

🔧 Temporary Workarounds

Network Access Restriction

linux

Restrict LDAP access to trusted sources only

firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="TRUSTED_IP" port protocol="tcp" port="389" accept'
firewall-cmd --reload

Query Rate Limiting

all

Implement rate limiting on LDAP queries

Configure in 389-ds slapd.conf or cn=config

🧯 If You Can't Patch

Implement strict network segmentation and firewall rules to limit LDAP access
Monitor LDAP query patterns and set up alerts for unusual activity

🔍 How to Verify

Check if Vulnerable:

Check 389-ds-base package version against Red Hat advisories

Check Version:

rpm -q 389-ds-base

Verify Fix Applied:

Verify package version is updated and service is running

📡 Detection & Monitoring

Log Indicators:

Unusual LDAP query patterns
Server crash/restart logs
High error rates in access logs

Network Indicators:

Unusual LDAP traffic patterns
Multiple malformed queries from single source

SIEM Query:

source="ldap" AND (error OR crash OR restart)

📊 Metadata

CVE ID: CVE-2024-3657

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-20

Published: May 28, 2024

Last Updated: November 3, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2024-3657, you might also want to check these: