BIT-openldap-2020-36229: High severity openldap OpenLDAP vulnerability

Q: Which deployments are exposed to this denial-of-service issue?

OpenLDAP deployments using a version before 2.4.57 are affected. The vulnerable code path is in slapd's X.509 distinguished-name parsing.

Q: Does exploitation require authentication or user interaction?

No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

Q: What is the expected impact of a successful attack?

A successful attack can crash slapd, causing a denial of service. The provided impact data indicates no confidentiality or integrity impact.

Published Jan 26, 2021

Updated

A flaw was discovered in ldapX509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in adkeystring, resulting in denial of service.

Affected Software

1 affected component

openldap OpenLDAP<2.4.57

Event History

Jan 26, 2021

CVE Published

via OSV·06:15 PM

Data Sourced

via OSV·06:15 PM

DescriptionSeverity

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

OpenLDAP deployments using a version before 2.4.57 are affected. The vulnerable code path is in slapd's X.509 distinguished-name parsing.

Does exploitation require authentication or user interaction?

No. The supplied vector indicates network reachability, low attack complexity, no privileges required, and no user interaction.

What is the expected impact of a successful attack?

A successful attack can crash slapd, causing a denial of service. The provided impact data indicates no confidentiality or integrity impact.

BIT-openldap-2020-36229: High severity openldap OpenLDAP vulnerability

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploitation require authentication or user interaction?

What is the expected impact of a successful attack?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Does exploitation require authentication or user interaction?

What is the expected impact of a successful attack?