PT-2020-13069 · Openldap+6 · Openldap+6

Published 2020-04-28 · Updated 2024-03-06 · CVE-2020-12243

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.50

Description The issue arises from LDAP search filters with nested boolean expressions, which can cause a denial of service (daemon crash) in the slapd component of OpenLDAP.

Recommendations For versions prior to 2.4.50, update to version 2.4.50 or later to resolve the issue.

Exploit

Fix

DoS

Uncontrolled Recursion

Weakness Enumeration

CWE-674

Related Identifiers

ALT-PU-2020-3121

ALT-PU-2020-3151

ALT-PU-2020-3190

BIT-OPENLDAP-2020-12243

CESA-2020_4041

CVE-2020-12243

DLA-2199-1

DSA-4666-1

MGASA-2020-0200

OPENSUSE-SU-2020:0647-1

OPENSUSE-SU-2020_0647-1

RHSA-2020:4041

RHSA-2020_4041

SUSE-SU-2020:1193-1

SUSE-SU-2020:1210-1

SUSE-SU-2020:1219-1

SUSE-SU-2020:14358-1

SUSE-SU-2020_1193-1

SUSE-SU-2020_1219-1

SUSE-SU-2020_14358-1

USN-4352-1

USN-4352-2

Affected Products

Alt Linux

Centos

Linuxmint

Openldap

Red Hat

Suse

Ubuntu

References · 54

• 🔥 https://bugs.openldap.org/show_bug.cgi?id=9202 · Exploit
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-12243 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2020.html · Patch
• https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-4041.html · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1219-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4352-1 · Vendor Advisory
• https://debian.org/security/2020/dsa-4666 · Vendor Advisory
• https://usn.ubuntu.com/4352-2 · Vendor Advisory
• https://usn.ubuntu.com/4352-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-12243 · Security Note
• https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:1210-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-12243 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4352-2 · Vendor Advisory