PT-2021-5553 · Openldap+7 · Openldap+7

Published 2021-01-25 · Updated 2025-08-17 · CVE-2020-36227

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57

Description A flaw was discovered in OpenLDAP leading to an infinite loop in slapd with the cancel extop Cancel operation, resulting in denial of service. This issue can be exploited by a remote attacker by sending a specially crafted request, allowing them to execute a denial of service.

Recommendations For OpenLDAP versions prior to 2.4.57, update to version 2.4.57 or later to resolve the issue. As a temporary workaround, consider disabling the cancel extop operation in the slapd configuration until a patch is applied.

Fix

DoS

Infinite Loop

Weakness Enumeration

CWE-835

Related Identifiers

ALT-PU-2021-1333

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-06403

BIT-OPENLDAP-2020-36227

CVE-2020-36227

DLA-2544-1

DSA-4845-1

MGASA-2021-0105

OESA-2021-1062

OPENSUSE-SU-2021:0408-1

OPENSUSE-SU-2021_0408-1

ROSA-SA-2025-2550

SUSE-SU-2021:0692-1

SUSE-SU-2021:0693-1

SUSE-SU-2021:0723-1

SUSE-SU-2021:14700-1

SUSE-SU-2021_14700-1

USN-4724-1

USN-7698-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Apple Macos

Openldap

Red Os

Suse

Ubuntu

References · 108

• https://nvd.nist.gov/vuln/detail/CVE-2020-36230 · Security Note
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0693-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36226 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36227 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2020-36227 · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2020-36227 · Vendor Advisory
• https://bugs.openldap.org/show_bug.cgi?id=9428 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36228 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-36227 · Security Note
• https://osv.dev/vulnerability/DLA-2544-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36226 · Vendor Advisory
• https://debian.org/security/2021/dsa-4845 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7698-1 · Vendor Advisory