OpenLDAP Denial of Service Vulnerability (CVE-2021-27212)
Summary
CVE-2021-27212: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short t... Affects openldap across 4 version ranges.
< 2.4.50-r2
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
< 4f2d6dd1ff980b7b51b0a8bbcbb08cdaa96826a3
< 7e717b033a73e47e7fadeee378e6aae28884e050
Fixed in 2.4.50-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing user authentication and authorization. It is widely used in various applications and systems for centralized user management. However, OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha are vulnerable to a denial of service (DoS) attack due to an assertion failure in the issuerAndThisUpdateCheck function. This vulnerability can be exploited by sending a crafted packet with a short timestamp, causing the slapd daemon to exit unexpectedly.
Vulnerability Detail
The vulnerability (CVE-2021-27212) originates from a flaw in the schema_init.c file of OpenLDAP. By exploiting this vulnerability, an attacker can trigger an assertion failure in the issuerAndThisUpdateCheck function by sending a specially crafted packet with a short timestamp. This assertion failure leads to a DoS condition, causing the slapd daemon to exit abruptly. The impact of this vulnerability is limited to a denial of service, and there is no evidence of it leading to remote code execution or information disclosure.
How To Fix
Minimum fixed version
2.4.50-r2
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No known workarounds are available for this vulnerability. It is advised to apply the official patch or update to the latest version of OpenLDAP as soon as possible.
Conclusion
The OpenLDAP Denial of Service Vulnerability (CVE-2021-27212) can be exploited to cause a denial of service condition in OpenLDAP versions 2.4.57 and 2.5.x through 2.5.1alpha. It is crucial to update OpenLDAP to the latest version or apply the official patch to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing user authentication and authorization.
The vulnerability (CVE-2021-27212) can be exploited to cause a denial of service (DoS) condition, resulting in the slapd daemon exiting unexpectedly. However, there is no evidence of remote code execution or information disclosure.
To fix this vulnerability, update OpenLDAP to version 2.4.57 or later. Apply the official patch or use your package manager to obtain the updated version.
No known workarounds are available for this vulnerability. It is recommended to apply the official patch or update to the latest version of OpenLDAP.
You can find more information about this vulnerability, including technical details and affected versions, in the official CVE-2021-27212 advisory.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
