BIT-openldap-2021-27212: High severity openldap OpenLDAP vulnerability

Q: Which OpenLDAP deployments are in scope?

OpenLDAP versions through 2.4.57 and 2.5.x through 2.5.1alpha are identified as affected.

Q: Does exploitation require authentication or user interaction?

No. The vulnerability is rated AV:N/AC:L/PR:N/UI:N, indicating network reachability, low attack complexity, no privileges, and no user interaction are required.

Q: What is the expected impact if exploitation succeeds?

A crafted packet containing a short timestamp can trigger an assertion failure in slapd, causing the daemon to exit and resulting in denial of service.

Published Feb 14, 2021

Updated

In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schemainit.c and checkTime.

Affected Software

1 affected component

openldap OpenLDAP<=2.4.57, >=2.5.0<=2.5.1alpha

Event History

Feb 14, 2021

CVE Published

via OSV·03:15 AM

Data Sourced

via OSV·03:15 AM

DescriptionSeverity

Frequently Asked Questions

Which OpenLDAP deployments are in scope?

OpenLDAP versions through 2.4.57 and 2.5.x through 2.5.1alpha are identified as affected.

Does exploitation require authentication or user interaction?

No. The vulnerability is rated AV:N/AC:L/PR:N/UI:N, indicating network reachability, low attack complexity, no privileges, and no user interaction are required.

What is the expected impact if exploitation succeeds?

A crafted packet containing a short timestamp can trigger an assertion failure in slapd, causing the daemon to exit and resulting in denial of service.

BIT-openldap-2021-27212: High severity openldap OpenLDAP vulnerability

Affected Software

Event History

Frequently Asked Questions

Which OpenLDAP deployments are in scope?

Does exploitation require authentication or user interaction?

What is the expected impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Which OpenLDAP deployments are in scope?

Does exploitation require authentication or user interaction?

What is the expected impact if exploitation succeeds?