BIT-openldap-2020-36227: High severity openldap OpenLDAP vulnerability

Q: Which deployments are exposed?

OpenLDAP deployments running a version before 2.4.57 are affected. The flaw is in slapd and concerns the cancel_extop Cancel operation.

Q: Does exploitation require authentication or user interaction?

No. The provided severity vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction.

Q: What is the likely impact of a successful attack?

A successful attack can cause slapd to enter an infinite loop, resulting in denial of service. The provided impact data identifies availability impact only, with no confidentiality or integrity impact.

Published Jan 26, 2021

Updated

A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancelextop Cancel operation, resulting in denial of service.

Affected Software

1 affected component

openldap OpenLDAP<2.4.57

Event History

Jan 26, 2021

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed?

OpenLDAP deployments running a version before 2.4.57 are affected. The flaw is in slapd and concerns the cancel_extop Cancel operation.

Does exploitation require authentication or user interaction?

No. The provided severity vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction.

What is the likely impact of a successful attack?

A successful attack can cause slapd to enter an infinite loop, resulting in denial of service. The provided impact data identifies availability impact only, with no confidentiality or integrity impact.

BIT-openldap-2020-36227: High severity openldap OpenLDAP vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What is the likely impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

Does exploitation require authentication or user interaction?

What is the likely impact of a successful attack?