PT-2021-5554 · Openldap+7 · Openldap+7

Padma81 · Published 2021-01-25 · Updated 2025-08-17 · CVE-2020-36223

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions OpenLDAP versions prior to 2.4.57

Description The issue is related to a double free memory error during the handling of the Values Return Filter control, which can lead to a denial of service (DoS) when a specially crafted request is sent to slapd. This can cause the slapd service to crash, resulting in an out-of-bounds read. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited.

Recommendations For OpenLDAP versions prior to 2.4.57, update to version 2.4.57 or later to resolve the issue. As a temporary workaround, consider restricting access to the Values Return Filter control to minimize the risk of exploitation.

Fix

DoS

Double Free

Out of bounds Read

Weakness Enumeration

CWE-415

CWE-125

Related Identifiers

ALT-PU-2021-1333

ALT-PU-2021-1352

ALT-PU-2021-1354

BDU:2021-06404

BIT-OPENLDAP-2020-36223

CVE-2020-36223

DLA-2544-1

DSA-4845-1

MGASA-2021-0105

OESA-2021-1062

OPENSUSE-SU-2021:0408-1

OPENSUSE-SU-2021_0408-1

ROSA-SA-2025-2550

SUSE-SU-2021:0692-1

SUSE-SU-2021:0693-1

SUSE-SU-2021:0723-1

SUSE-SU-2021:14700-1

SUSE-SU-2021_14700-1

USN-4724-1

USN-7698-1

Affected Products

Alt Linux

Astra Linux

Linuxmint

Apple Macos

Openldap

Red Os

Suse

Ubuntu

References · 107

• https://nvd.nist.gov/vuln/detail/CVE-2020-36230 · Security Note
• https://git.openldap.org/openldap/openldap/-/commit/21981053a1195ae1555e23df4d9ac68d34ede9dd · Vendor Advisory
• https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36228 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0693-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36226 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-36228 · Security Note
• https://osv.dev/vulnerability/DLA-2544-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-36226 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-36223 · Vendor Advisory
• https://debian.org/security/2021/dsa-4845 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7698-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-36223 · Security Note
• https://osv.dev/vulnerability/USN-4724-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0723-1 · Vendor Advisory