BIT-openldap-2020-25692: Null Pointer Dereference

Q: Which deployments are exposed to this denial-of-service issue?

OpenLDAP server deployments running a version prior to 2.4.55 are affected. The issue is in slapd handling of requests that rename RDNs.

Q: Does exploiting this require authentication or user interaction?

No. An unauthenticated remote attacker can trigger the flaw by sending a specially crafted request, and no user interaction is required.

Q: What is the expected impact if exploitation succeeds?

Successful exploitation can crash the slapd process, causing a denial of service. The provided information indicates no confidentiality or integrity impact.

Q: What version contains the fix?

The issue was fixed in OpenLDAP 2.4.55.

Published Dec 8, 2020

Updated

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.

Affected Software

1 affected component

openldap OpenLDAP server<2.4.55

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade openldap to a version that resolves this vulnerability.
Fixed in 2.4.55

Event History

Dec 8, 2020

CVE Published

via OSV·01:15 AM

Data Sourced

via OSV·01:15 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

OpenLDAP server deployments running a version prior to 2.4.55 are affected. The issue is in slapd handling of requests that rename RDNs.

Does exploiting this require authentication or user interaction?

No. An unauthenticated remote attacker can trigger the flaw by sending a specially crafted request, and no user interaction is required.

What is the expected impact if exploitation succeeds?

Successful exploitation can crash the slapd process, causing a denial of service. The provided information indicates no confidentiality or integrity impact.

What version contains the fix?

The issue was fixed in OpenLDAP 2.4.55.

BIT-openldap-2020-25692: Null Pointer Dereference

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploiting this require authentication or user interaction?

What is the expected impact if exploitation succeeds?

What version contains the fix?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploiting this require authentication or user interaction?

What is the expected impact if exploitation succeeds?

What version contains the fix?