BIT-openldap-2020-25710: High severity openldap OpenLDAP vulnerability

Q: Which deployments are exposed to this issue?

OpenLDAP versions before 2.4.56 are affected. The issue can be triggered by a malicious packet processed by OpenLDAP.

Q: Does exploitation require authentication or user interaction?

No. The severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.

Q: What is the likely impact of a successful attack?

A malicious packet can force a failed assertion in csnNormalize23(), with the primary impact being denial of service and loss of availability. The provided severity vector indicates no confidentiality or integrity impact.

Published May 28, 2021

Updated

A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.

Affected Software

1 affected component

openldap OpenLDAP<2.4.56

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade OpenLDAP to a version that resolves this vulnerability.
Fixed in 2.4.56

Event History

May 28, 2021

CVE Published

via OSV·11:15 AM

Data Sourced

via OSV·11:15 AM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed to this issue?

OpenLDAP versions before 2.4.56 are affected. The issue can be triggered by a malicious packet processed by OpenLDAP.

Does exploitation require authentication or user interaction?

No. The severity vector indicates network access, low attack complexity, no privileges required, and no user interaction.

What is the likely impact of a successful attack?

A malicious packet can force a failed assertion in csnNormalize23(), with the primary impact being denial of service and loss of availability. The provided severity vector indicates no confidentiality or integrity impact.

BIT-openldap-2020-25710: High severity openldap OpenLDAP vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the likely impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this issue?

Does exploitation require authentication or user interaction?

What is the likely impact of a successful attack?