Denial of Service Vulnerability in OpenLDAP - CVE-2021-27212
Summary
ALPINE-CVE-2021-27212: In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short t... Affects openldap versions < 2.4.50-r2. Fixed in 2.4.50-r2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), which is used for accessing and maintaining distributed directory information services over an Internet Protocol (IP) network. It is widely utilized for user authentication and directory services in various applications. The vulnerability in question affects multiple versions of OpenLDAP, making it critical for users to be aware of its implications.
Vulnerability Detail
In OpenLDAP versions up to 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure can occur in the slapd daemon due to a crafted packet sent to the issuerAndThisUpdateCheck function. This vulnerability can lead to a denial of service, causing the daemon to exit unexpectedly when a short timestamp is processed. The issue is related to the schema initialization process and can be exploited by attackers to disrupt service availability.
How To Fix
Minimum fixed version
2.4.50-r2
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider implementing network-level protections such as firewalls to filter out potentially malicious packets that could exploit this vulnerability. Additionally, monitor your OpenLDAP logs for unusual activity that may indicate an attempted exploit.
Conclusion
CVE-2021-27212 represents a significant vulnerability in OpenLDAP that can lead to service disruptions. Users are strongly advised to update their installations to the patched versions to mitigate the risk. Additionally, employing temporary workarounds can help protect against potential exploits until an update can be applied.
See every vulnerability recorded for openldap →
FAQ
CVE-2021-27212 is a vulnerability in OpenLDAP that can lead to a denial of service due to an assertion failure in the slapd daemon.
OpenLDAP versions up to 2.4.57 and 2.5.x through 2.5.1alpha are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score of CVE-2021-27212 is 7.5, indicating a high severity level.
If immediate updates are not possible, consider implementing network-level protections and monitoring logs for unusual activities.
References
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
