Infinite Loop Denial of Service in OpenLDAP
Summary
CVE-2020-36227: A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP). It provides a directory service for managing and accessing distributed directory information. OpenLDAP is widely used in various applications and systems for user authentication and directory services. However, a vulnerability has been discovered in OpenLDAP before version 2.4.57 that can lead to an infinite loop in the slapd daemon, resulting in a denial of service (DoS) condition.
Vulnerability Detail
The vulnerability, identified as CVE-2020-36227, occurs when the cancel_extop Cancel operation is processed by the slapd daemon. An attacker can exploit this flaw to trigger an infinite loop, causing the slapd process to consume excessive CPU resources and resulting in a denial of service. This vulnerability can be exploited remotely without authentication, making it a significant security concern. The Common Vulnerability Scoring System (CVSS) score for this vulnerability is 7.5, indicating a high severity level.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or update to a fixed version of OpenLDAP to address the issue.
Conclusion
In summary, OpenLDAP versions before 2.4.57 are vulnerable to an infinite loop denial of service issue. This vulnerability can be exploited remotely without authentication, leading to a significant impact on LDAP services. It is highly recommended to update OpenLDAP to version 2.4.57 or later to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) used for managing and accessing distributed directory information.
The vulnerability allows an attacker to trigger an infinite loop in the slapd daemon, leading to a denial of service condition. This can result in the unavailability of LDAP services and potential disruption of directory-based authentication and access control.
Yes, this vulnerability can be exploited remotely without authentication, making it a significant security concern.
No, there is no known workaround for this vulnerability. It is crucial to update OpenLDAP to a fixed version.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
