PT-2021-5535 · Openldap+7 · Openldap+7

Csaba Fitzl + 2 · Published 2021-01-25 · Updated 2025-08-19 · CVE-2020-36221

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57

Description The issue is related to an integer underflow in the OpenLDAP implementation, which can be exploited by a remote attacker to cause a denial of service. This is achieved by sending a specially crafted request that triggers a crash in the Certificate Exact Assertion processing, specifically in the serialNumberAndIssuerCheck function within schema init.c. The exploitation can result in the slapd service crashing.

Recommendations For versions prior to 2.4.57, update to version 2.4.57 or later to resolve the issue. As a temporary workaround, consider restricting access to the Certificate Exact Assertion processing to minimize the risk of exploitation.

Fix

RCE

DoS

Integer Underflow

Weakness Enumeration

CWE-191

Related Identifiers

ALT-PU-2021-1333

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-06385

BIT-OPENLDAP-2020-36221

CVE-2020-36221

DLA-2544-1

DSA-4845-1

MGASA-2021-0105

OESA-2021-1062

OPENSUSE-SU-2021:0408-1

OPENSUSE-SU-2021_0408-1

ROSA-SA-2025-2550

SUSE-SU-2021:0692-1

SUSE-SU-2021:0693-1

SUSE-SU-2021:0723-1

SUSE-SU-2021:14700-1

SUSE-SU-2021_0692-1

SUSE-SU-2021_0693-1

SUSE-SU-2021_0723-1

SUSE-SU-2021_14700-1

USN-4724-1

USN-7698-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Apple Macos

Openldap

Red Os

Suse

Ubuntu

References · 108

• https://nvd.nist.gov/vuln/detail/CVE-2020-36230 · Security Note
• https://bugs.openldap.org/show_bug.cgi?id=9404 · Vendor Advisory
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0693-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-36221 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36226 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36228 · Security Note
• https://osv.dev/vulnerability/DLA-2544-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36226 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36221 · Vendor Advisory
• https://debian.org/security/2021/dsa-4845 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7698-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-06385 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36221 · Vendor Advisory