PT-2021-5533 · Openldap+7 · Openldap+7

Published 2021-01-25 · Updated 2025-08-17 · CVE-2020-36226

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57

Description A flaw in OpenLDAP leads to a memch->bv len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. The issue is related to a resource management error. An attacker can exploit this flaw by sending a specially crafted request to slapd, allowing them to perform a denial of service attack.

Recommendations For OpenLDAP versions prior to 2.4.57, this issue was addressed with improved checks, implying that updating to version 2.4.57 or later should resolve the issue. As a temporary workaround, consider restricting access to the saslAuthzTo processing in slapd to minimize the risk of exploitation.

Fix

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2021-1333

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-06383

BIT-OPENLDAP-2020-36226

CVE-2020-36226

DLA-2544-1

DSA-4845-1

MGASA-2021-0105

OESA-2021-1062

OPENSUSE-SU-2021:0408-1

OPENSUSE-SU-2021_0408-1

ROSA-SA-2025-2550

SUSE-SU-2021:0692-1

SUSE-SU-2021:0693-1

SUSE-SU-2021:0723-1

SUSE-SU-2021:14700-1

SUSE-SU-2021_14700-1

USN-4724-1

USN-7698-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Apple Macos

Openldap

Red Os

Suse

Ubuntu

References · 112

• https://bdu.fstec.ru/vul/2021-06383 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36230 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36226 · Vendor Advisory
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0693-1 · Vendor Advisory
• https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36226 · Security Note
• https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36228 · Security Note
• https://osv.dev/vulnerability/DLA-2544-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-36226 · Security Note
• https://ubuntu.com/security/CVE-2020-36226 · Vendor Advisory
• https://debian.org/security/2021/dsa-4845 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7698-1 · Vendor Advisory