OpenLDAP Denial of Service Vulnerability (CVE-2020-36226)
Summary
CVE-2020-36226: A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing user accounts and authentication. It is widely used in various applications and systems for centralized user management. However, a vulnerability has been discovered in OpenLDAP before version 2.4.57 that can lead to a denial of service (DoS) attack. This vulnerability affects the saslAuthzTo processing and can result in a crash of the slapd service, rendering it unavailable.
Vulnerability Detail
The vulnerability (CVE-2020-36226) in OpenLDAP arises from a miscalculation in the memch->bv_len parameter during the saslAuthzTo processing. This flaw can be exploited by an attacker to cause a crash in the slapd service, leading to a denial of service condition. The impact of this vulnerability is the unavailability of the LDAP service, which can disrupt user authentication and access control mechanisms relying on OpenLDAP.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
No workaround has been identified for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of OpenLDAP.
Conclusion
The OpenLDAP Denial of Service vulnerability (CVE-2020-36226) can result in a crash of the slapd service, causing a denial of service condition. To mitigate this vulnerability, it is crucial to upgrade OpenLDAP to version 2.4.57 or later. No workaround is available, and it is recommended to follow the official documentation for the upgrade process. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing user accounts and authentication.
The vulnerability can lead to a denial of service (DoS) condition, rendering the OpenLDAP service unavailable and disrupting user authentication and access control mechanisms.
To fix this vulnerability, it is recommended to upgrade OpenLDAP to version 2.4.57 or later, which includes the necessary fixes.
No workaround has been identified for this vulnerability. Upgrading to the patched version is the recommended solution.
You can find more information about this vulnerability in the official CVE-2020-36226 advisory and the OpenLDAP project documentation.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
