BIT-openldap-2020-36228: High severity openldap OpenLDAP vulnerability

Q: Does exploiting this issue require authentication or user interaction?

No. The CVSS vector indicates no privileges are required and no user interaction is needed.

Q: What security impact is indicated beyond service availability?

The reported CVSS vector indicates no confidentiality or integrity impact. The impact is limited to availability, with a high availability rating.

Q: How accessible is exploitation to a remote attacker?

The CVSS vector rates the attack as network-accessible and low complexity, indicating an attacker can attempt exploitation remotely without specialized preconditions identified in the provided data.

Published Jan 26, 2021

Updated

An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.

Affected Software

1 affected component

openldap OpenLDAP<2.4.57

Event History

Jan 26, 2021

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Frequently Asked Questions

Does exploiting this issue require authentication or user interaction?

No. The CVSS vector indicates no privileges are required and no user interaction is needed.

What security impact is indicated beyond service availability?

The reported CVSS vector indicates no confidentiality or integrity impact. The impact is limited to availability, with a high availability rating.

How accessible is exploitation to a remote attacker?

The CVSS vector rates the attack as network-accessible and low complexity, indicating an attacker can attempt exploitation remotely without specialized preconditions identified in the provided data.

BIT-openldap-2020-36228: High severity openldap OpenLDAP vulnerability

Affected Software

Event History

Frequently Asked Questions

Does exploiting this issue require authentication or user interaction?

What security impact is indicated beyond service availability?

How accessible is exploitation to a remote attacker?

Company

Resources

Contact

Frequently Asked Questions

Does exploiting this issue require authentication or user interaction?

What security impact is indicated beyond service availability?

How accessible is exploitation to a remote attacker?