OpenLDAP Denial of Service Vulnerability (CVE-2020-36224)
Summary
CVE-2020-36224: A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing and accessing distributed directory information. It is widely used for authentication and authorization purposes in various applications. However, OpenLDAP versions before 2.4.57 are vulnerable to a denial of service (DoS) attack due to an invalid pointer free and slapd crash in the saslAuthzTo processing. This vulnerability can be exploited by an attacker to crash the slapd service, resulting in a denial of service.
Vulnerability Detail
The vulnerability (CVE-2020-36224) in OpenLDAP arises from an invalid pointer free and slapd crash in the saslAuthzTo processing. When processing saslAuthzTo directives, OpenLDAP fails to properly handle certain input, leading to an invalid pointer free and subsequent slapd crash. This vulnerability can be triggered by an attacker with the ability to send crafted requests to the affected OpenLDAP server. Successful exploitation of this vulnerability can result in a denial of service, rendering the LDAP service unavailable to legitimate users.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch or upgrade to the fixed version of OpenLDAP.
Conclusion
The OpenLDAP denial of service vulnerability (CVE-2020-36224) can be exploited by an attacker to crash the slapd service, resulting in a denial of service. To mitigate this risk, it is crucial to upgrade to OpenLDAP version 2.4.57 or later. Applying the official patch or upgrading to the fixed version will ensure the proper handling of saslAuthzTo directives and prevent the invalid pointer free issue. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing and accessing distributed directory information.
The vulnerability allows an attacker to crash the OpenLDAP slapd service, resulting in a denial of service and rendering the LDAP service unavailable to legitimate users.
To fix the vulnerability, it is recommended to upgrade to OpenLDAP version 2.4.57 or later, which includes a patch for the issue.
There is no known workaround for this vulnerability. It is recommended to apply the official patch or upgrade to the fixed version of OpenLDAP.
You can find more information about this vulnerability in the CVE-2020-36224 advisory and the provided database-specific source.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
