OpenLDAP Denial of Service Vulnerability (CVE-2020-36222)
Summary
CVE-2020-36222: A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides directory services for managing and accessing distributed directory information. It is widely used for authentication and authorization purposes in various applications and systems. However, OpenLDAP versions before 2.4.57 are vulnerable to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability (CVE-2020-36222) in OpenLDAP arises from a flaw in the saslAuthzTo validation. An attacker can exploit this vulnerability to trigger an assertion failure in slapd, leading to a DoS condition. By sending specially crafted requests, an attacker can cause the slapd process to crash, resulting in a denial of service for legitimate users and potentially disrupting the availability of the LDAP service. The severity of this vulnerability is rated as high with a CVSS score of 7.5.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by updating OpenLDAP to a patched version.
Conclusion
The OpenLDAP Denial of Service vulnerability (CVE-2020-36222) can be mitigated by updating OpenLDAP to version 2.4.57 or later. This fix addresses the flaw in saslAuthzTo validation and prevents the assertion failure in slapd, which could lead to a denial of service condition. It is crucial for users to promptly update their OpenLDAP installations to ensure the security and stability of their LDAP services. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides directory services for managing and accessing distributed directory information.
The vulnerability allows an attacker to trigger a denial of service condition in OpenLDAP, potentially disrupting the availability of LDAP services and causing inconvenience to legitimate users.
To fix this vulnerability, update OpenLDAP to version 2.4.57 or later, which includes a patch for the flaw.
No, there is no known workaround for this vulnerability. It is necessary to apply the official fix by updating OpenLDAP.
The severity of this vulnerability is rated as high with a CVSS score of 7.5.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
