PT-2021-5551 · Openldap+7 · Openldap+7

Padma81 · Published 2021-01-25 · Updated 2025-08-24 · CVE-2020-36229

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57

Description The issue is related to an incompatible type access in the OpenLDAP protocol implementation. It allows a remote attacker to send a specially crafted request to slapd, potentially leading to a denial of service (DoS) attack. The flaw is in the ldap X509dn2bv function and affects the X.509 DN parsing in ad keystring, causing a slapd crash.

Recommendations For OpenLDAP versions prior to 2.4.57, update to version 2.4.57 or later to resolve the issue. As a temporary workaround, consider restricting access to the vulnerable ldap X509dn2bv function until a patch is available.

Fix

DoS

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALT-PU-2021-1333

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-06401

BIT-OPENLDAP-2020-36229

CVE-2020-36229

DLA-2544-1

DSA-4845-1

MGASA-2021-0105

OESA-2021-1062

OPENSUSE-SU-2021:0408-1

OPENSUSE-SU-2021_0408-1

ROSA-SA-2025-2550

SUSE-SU-2021:0692-1

SUSE-SU-2021:0693-1

SUSE-SU-2021:0723-1

SUSE-SU-2021:14700-1

SUSE-SU-2021_14700-1

USN-4724-1

USN-7713-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Apple Macos

Openldap

Red Os

Suse

Ubuntu

References · 109

• https://nvd.nist.gov/vuln/detail/CVE-2020-36230 · Security Note
• https://osv.dev/vulnerability/BIT-openldap-2020-36229 · Vendor Advisory
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0693-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36229 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-36229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36226 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36228 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-36229 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2544-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36229 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36226 · Vendor Advisory
• https://debian.org/security/2021/dsa-4845 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-36229 · Vendor Advisory