Critical Denial of Service Vulnerability in OpenLDAP Package
Summary
ALPINE-CVE-2020-25692: A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. Affects openldap versions < 2.4.48-r2. Fixed in 2.4.48-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), which is used for directory services. It provides a robust framework for managing user data and authentication in various applications. However, certain versions of OpenLDAP are vulnerable to a NULL pointer dereference issue, which can lead to service disruptions.
Vulnerability Detail
A NULL pointer dereference was discovered in the OpenLDAP server, specifically during requests for renaming Relative Distinguished Names (RDNs). This vulnerability allows an unauthenticated attacker to send specially crafted requests that can crash the slapd process, resulting in a Denial of Service (DoS). The vulnerability was identified in versions prior to the patched releases and has a CVSS score of 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.4.48-r2
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate patching is not feasible, consider implementing network-level controls to restrict access to the OpenLDAP server, thereby mitigating the risk of exploitation until a proper update can be applied.
Conclusion
The identified vulnerability in OpenLDAP poses a significant risk of Denial of Service attacks. It is crucial for users to update their installations to the latest patched versions to mitigate this risk. Additionally, utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for openldap →
FAQ
The vulnerability is a NULL pointer dereference that can lead to a Denial of Service by crashing the OpenLDAP server.
Versions prior to 2.4.48-r2 for Alpine v3.10, 2.4.48-r3 for Alpine v3.11, and 2.4.50-r1 for Alpine v3.12 are affected.
You can use the Vulert playground at Vulert Scanner to check if your application is impacted by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
Implement network-level controls to restrict access to the OpenLDAP server until you can apply the necessary updates.
References
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
