Integer Underflow in OpenLDAP leading to Denial of Service (CVE-2020-36221)
Summary
CVE-2020-36221: An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck). Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing and accessing distributed directory information. It is widely used for authentication, authorization, and storing user and group information. OpenLDAP is a critical component in many systems and applications.
Vulnerability Detail
The vulnerability identified as CVE-2020-36221 is an integer underflow issue in OpenLDAP versions prior to 2.4.57. This vulnerability affects the Certificate Exact Assertion processing in slapd, the OpenLDAP server daemon. An attacker can exploit this vulnerability to cause a crash in slapd, resulting in a denial of service (DoS) condition. The specific component affected is the serialNumberAndIssuerCheck function in schema_init.c. The vulnerability is caused by improper handling of integer values, leading to an underflow condition.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the fixed version of OpenLDAP to mitigate the risk.
Conclusion
The integer underflow vulnerability in OpenLDAP can lead to a denial of service (DoS) condition by crashing the server. It is crucial for users of OpenLDAP to upgrade to version 2.4.57 or later to mitigate this vulnerability. Applying the official patch or upgrade will ensure the security and stability of systems relying on OpenLDAP for directory services. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing and accessing distributed directory information.
The vulnerability can be exploited by an attacker to crash the OpenLDAP server, leading to a denial of service (DoS) condition. This can disrupt the availability of the directory service and impact the functionality of systems relying on OpenLDAP for authentication and authorization.
To fix this vulnerability, it is recommended to upgrade OpenLDAP to version 2.4.57 or later. This version includes the necessary patches and fixes to address the integer underflow issue.
There is no known workaround for this vulnerability. It is essential to apply the official patch or upgrade to the fixed version of OpenLDAP to mitigate the risk.
You can find more information about this vulnerability in the CVE-2020-36221 advisory and the OpenLDAP documentation.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
