BIT-openldap-2020-36221: High severity openldap OpenLDAP vulnerability

Q: Which deployments are exposed?

OpenLDAP deployments running a version before 2.4.57 are affected where the slapd service can be reached by an attacker over the network.

Q: What access does an attacker need to trigger the issue?

The supplied vector indicates network access is sufficient; no privileges or user interaction are required.

Q: What is the expected impact of successful exploitation?

Successful exploitation can crash slapd, causing a high-availability-impact denial of service. The supplied vector indicates no confidentiality or integrity impact.

Published Jan 26, 2021

Updated

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schemainit.c serialNumberAndIssuerCheck).

Affected Software

1 affected component

openldap OpenLDAP<2.4.57

Event History

Jan 26, 2021

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed?

OpenLDAP deployments running a version before 2.4.57 are affected where the slapd service can be reached by an attacker over the network.

What access does an attacker need to trigger the issue?

The supplied vector indicates network access is sufficient; no privileges or user interaction are required.

What is the expected impact of successful exploitation?

Successful exploitation can crash slapd, causing a high-availability-impact denial of service. The supplied vector indicates no confidentiality or integrity impact.

BIT-openldap-2020-36221: High severity openldap OpenLDAP vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to trigger the issue?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What access does an attacker need to trigger the issue?

What is the expected impact of successful exploitation?