BIT-openldap-2020-36222: High severity openldap OpenLDAP vulnerability

Q: What attacker access is required to trigger the issue?

The attack vector is network-based and requires no privileges or user interaction. An unauthenticated remote attacker can target the affected slapd service.

Q: What is the operational impact of successful exploitation?

Successful exploitation causes an assertion failure in slapd, resulting in denial of service. The provided severity vector indicates availability impact only, with no confidentiality or integrity impact.

Q: Which deployments should be prioritized for remediation?

Prioritize OpenLDAP deployments running versions before 2.4.57 where slapd is in use, particularly systems that expose the service to untrusted networks.

Published Jan 26, 2021

Updated

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

Affected Software

1 affected component

openldap OpenLDAP<2.4.57

Event History

Jan 26, 2021

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Frequently Asked Questions

What attacker access is required to trigger the issue?

The attack vector is network-based and requires no privileges or user interaction. An unauthenticated remote attacker can target the affected slapd service.

What is the operational impact of successful exploitation?

Successful exploitation causes an assertion failure in slapd, resulting in denial of service. The provided severity vector indicates availability impact only, with no confidentiality or integrity impact.

Which deployments should be prioritized for remediation?

Prioritize OpenLDAP deployments running versions before 2.4.57 where slapd is in use, particularly systems that expose the service to untrusted networks.

BIT-openldap-2020-36222: High severity openldap OpenLDAP vulnerability

Affected Software

Event History

Frequently Asked Questions

What attacker access is required to trigger the issue?

What is the operational impact of successful exploitation?

Which deployments should be prioritized for remediation?

Company

Resources

Contact

Frequently Asked Questions

What attacker access is required to trigger the issue?

What is the operational impact of successful exploitation?

Which deployments should be prioritized for remediation?