CVE catalog

CVE-2021-3480

slapi-nis: CVE-2021-3480

[CVE catalog]

Severity
High · CVSS 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Published
Source
[NVD] · [CVE record]
EPSS
1.70% · Oct 25, 2026

A flaw was found in slapi-nis in versions before 0.56.7. A NULL pointer dereference during the parsing of the Binding DN could allow an unauthenticated attacker to crash the 389-ds-base directory server. The highest threat from this vulnerability is to system availability.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianslapi-nissid0.60.0-1.1fixed
Debianslapi-nistrixie0.60.0-1.1fixed
Debianslapi-nisbookworm0.60.0-1fixed
Ubuntuslapi-nis16.040.54.2-1vulnerable
Ubuntuslapi-nis16.040.55-1vulnerable
Ubuntuslapi-nis18.040.56.1-1build1vulnerable
Ubuntuslapi-nis20.040.56.2-1build1vulnerable
Ubuntuslapi-nis22.040.56.5-2vulnerable
Ubuntuslapi-nis22.040.56.7-1vulnerable
Ubuntuslapi-nis24.040.60.0-1vulnerable
Ubuntuslapi-nis24.040.60.0-1build2vulnerable
Ubuntuslapi-nis24.040.60.0-1build3vulnerable
Ubuntuslapi-nis25.100.60.0-1.1vulnerable
Ubuntuslapi-nis26.040.60.0-1.1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianslapi-nissourcesid0.56.5-2not yet assignedNot reported[988736]
Debianslapi-nissourcetrixie0.56.5-2not yet assignedNot reported[988736]
Debianslapi-nissourcebookworm0.56.5-2not yet assignedNot reported[988736]

[Debian bug #988736]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [slapi-nis]Fixed
    Details (2)

    • 0.60.0-1 · amd64 · bookworm

      Fixed · Fixed: 0.56.5-2

      dsa · slapi-nis · debian · bookworm; dsa · slapi-nis · debian · 12

    • 0.60.0-1 · arm64 · bookworm

      Fixed · Fixed: 0.56.5-2

      dsa · slapi-nis · debian · bookworm; dsa · slapi-nis · debian · 12

[Debian 13 (Trixie)]

  • [slapi-nis]Fixed

    Source package: [slapi-nis]

    Details (2)

    • 0.60.0-1.1 · amd64 · trixie

      Fixed · Fixed: 0.56.5-2

      dsa · slapi-nis · debian · 13

    • 0.60.0-1.1+b1 · arm64 · trixie

      Fixed · Fixed: 0.56.5-2

      dsa · slapi-nis · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]