PT-2020-5834 · Openldap+5 · Openldap+5

Published 2020-07-12 · Updated 2024-03-06 · CVE-2020-25692

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions: OpenLDAP versions prior to 2.4.55

Description: The issue is related to a NULL pointer dereference in the OpenLDAP server, specifically during a request for renaming RDNs. This can be exploited by an unauthenticated attacker to remotely crash the slapd process by sending a specially crafted request, resulting in a Denial of Service.

Recommendations: For versions prior to 2.4.55, update to version 2.4.55 or later to resolve the issue. As a temporary workaround, consider restricting access to the renaming RDNs functionality until a patch is applied.

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2020-3560

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-01803

BIT-OPENLDAP-2020-25692

CVE-2020-25692

DLA-2425-1

DSA-4782-1

MGASA-2020-0407

OPENSUSE-SU-2020:1918-1

OPENSUSE-SU-2020:1920-1

OPENSUSE-SU-2020_1918-1

OPENSUSE-SU-2020_1920-1

RHSA-2021:1389

RHSA-2021_1389

SUSE-SU-2020:14541-1

SUSE-SU-2020:3313-1

SUSE-SU-2020:3314-1

SUSE-SU-2020:3315-1

SUSE-SU-2020_14541-1

SUSE-SU-2020_3313-1

SUSE-SU-2020_3314-1

SUSE-SU-2020_3315-1

USN-4622-1

USN-4622-2

Affected Products

Alt Linux

Linuxmint

Openldap

Red Hat

Suse

Ubuntu

References · 42

• https://osv.dev/vulnerability/DEBIAN-CVE-2020-25692 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-25692 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-25692 · Security Note
• https://osv.dev/vulnerability/USN-4622-1 · Vendor Advisory
• https://debian.org/security/2020/dsa-4782 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:3314-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2020:14541-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-25692 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2021-1389.html · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2425-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-25692 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1894567 · Patch
• https://bdu.fstec.ru/vul/2021-01803 · Security Note
• https://osv.dev/vulnerability/USN-4622-2 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2020:1920-1 · Vendor Advisory