PT-2021-5549 · Openldap+7 · Openldap+7

Published 2021-01-25 · Updated 2025-08-17 · CVE-2020-36224

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57

Description The issue is related to an invalid pointer free or reference release in the OpenLDAP implementation. Exploitation of this issue can allow a remote attacker to cause a denial of service by sending a specially crafted request, leading to a crash in the slapd process, specifically in the saslAuthzTo processing.

Recommendations For versions prior to 2.4.57, update to version 2.4.57 or later to resolve the issue. As a temporary workaround, consider restricting access to the saslAuthzTo processing to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-763

Related Identifiers

ALT-PU-2021-1333

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-06399

BIT-OPENLDAP-2020-36224

CVE-2020-36224

DLA-2544-1

DSA-4845-1

MGASA-2021-0105

OESA-2021-1062

OPENSUSE-SU-2021:0408-1

OPENSUSE-SU-2021_0408-1

ROSA-SA-2025-2550

SUSE-SU-2021:0692-1

SUSE-SU-2021:0693-1

SUSE-SU-2021:0723-1

SUSE-SU-2021:14700-1

SUSE-SU-2021_14700-1

USN-4724-1

USN-7698-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Apple Macos

Openldap

Red Os

Suse

Ubuntu

References · 110

• https://nvd.nist.gov/vuln/detail/CVE-2020-36230 · Security Note
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0693-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36224 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36226 · Security Note
• https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-36224 · Vendor Advisory
• https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36228 · Security Note
• https://osv.dev/vulnerability/DLA-2544-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36226 · Vendor Advisory
• https://debian.org/security/2021/dsa-4845 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7698-1 · Vendor Advisory
• https://bugs.openldap.org/show_bug.cgi?id=9409 · Vendor Advisory