PT-2021-5534 · Openldap+7 · Openldap+7

Padma81 · Published 2021-01-25 · Updated 2025-08-17 · CVE-2020-36225

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57

Description The issue is related to a double free vulnerability in the OpenLDAP protocol, which can be exploited by a remote attacker to cause a denial of service (DoS) by sending a specially crafted request to slapd. This can lead to a crash in the saslAuthzTo processing.

Recommendations For versions prior to 2.4.57, update to version 2.4.57 or later to resolve the issue. As a temporary workaround, consider restricting access to the saslAuthzTo processing to minimize the risk of exploitation.

Fix

DoS

Double Free

Weakness Enumeration

CWE-415

Related Identifiers

ALT-PU-2021-1333

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-06384

BIT-OPENLDAP-2020-36225

CVE-2020-36225

DLA-2544-1

DSA-4845-1

MGASA-2021-0105

OESA-2021-1062

OPENSUSE-SU-2021:0408-1

OPENSUSE-SU-2021_0408-1

ROSA-SA-2025-2550

SUSE-SU-2021:0692-1

SUSE-SU-2021:0693-1

SUSE-SU-2021:0723-1

SUSE-SU-2021:14700-1

SUSE-SU-2021_14700-1

USN-4724-1

USN-7698-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Apple Macos

Openldap

Red Os

Suse

Ubuntu

References · 108

• https://nvd.nist.gov/vuln/detail/CVE-2020-36230 · Security Note
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0693-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36226 · Security Note
• https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 · Vendor Advisory
• https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36228 · Security Note
• https://osv.dev/vulnerability/DLA-2544-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36226 · Vendor Advisory
• https://debian.org/security/2021/dsa-4845 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7698-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36223 · Security Note
• https://osv.dev/vulnerability/USN-4724-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36225 · Security Note