Security readout for executives and security teams
Plain-English summary
This issue can let an attacker crash a 389 Directory Server instance by sending crafted search activity. The stated impact is service instability or denial of service, not data theft or remote code execution. Business urgency depends on whether affected directory servers are reachable by untrusted users or networks.
Executive priority
Treat this as a timely availability risk for identity infrastructure. It is below critical urgency absent active exploitation or data compromise evidence, but directory outages can disrupt authentication, applications, and operations.
Technical view
CVE-2021-4091 is a CWE-415 double-free in 389-ds-base handling of virtual attributes context during persistent searches. The source bundle identifies 389-ds-base 1.3.10.2 as affected. A sequence of search requests can make the server behave unexpectedly and crash.
Likely exposure
Exposure is most likely on systems running the affected 389-ds-base package, especially directory servers that accept LDAP search traffic from broad internal or external populations. The bundle does not provide complete version ranges, CPEs, or platform-wide affected lists.
Exploitation context
The bundle reports no CISA KEV listing and provides no cited evidence of active exploitation. The described abuse path requires sending repeated search requests that trigger the vulnerable persistent-search handling path, with crash as the documented outcome.
Researcher notes
Evidence is narrow: the bundle names a double-free, persistent searches, virtual attributes context, and crash impact. It lacks CVSS, detailed fixed versions, exploit telemetry, and complete affected-version ranges. Avoid assuming code execution or broader product impact from the provided sources.
Mitigation direction
- Apply relevant 389-ds-base security updates from Red Hat or Debian guidance.
- Check vendor advisories for the exact fixed package version in each environment.
- Prioritize internet-facing or broadly reachable directory servers.
- Limit LDAP access to trusted networks where operationally feasible.
- Monitor directory service crashes until patched.
Validation and detection
- Inventory hosts running 389-ds-base and record package versions.
- Compare versions against Red Hat and Debian advisory guidance.
- Identify servers permitting persistent search activity from untrusted clients.
- Review service logs for unexpected crashes around LDAP search traffic.
- Confirm remediation by verifying updated package versions.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-415: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-4091 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://bugzilla.redhat.com/show_bug.cgi?id=2030307CVE reference
- [debian-lts-announce] 20230424 [SECURITY] [DLA 3399-1] 389-ds-base security updateCVE reference · mailing-list
- https://lists.debian.org/debian-lts-announce/2025/01/msg00015.htmlCVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Double Free
Double Free represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.