Integer Underflow Vulnerability in OpenLDAP
Summary
CVE-2020-36228: An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service. Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing user information. It is widely used for authentication and authorization purposes in various applications. However, a vulnerability has been discovered in OpenLDAP that can lead to a denial of service (DoS) attack.
Vulnerability Detail
The vulnerability, identified as CVE-2020-36228, is an integer underflow issue in OpenLDAP versions prior to 2.4.57. It occurs during the processing of the Certificate List Exact Assertion, which can result in a crash of the slapd service. An attacker can exploit this vulnerability to cause a DoS condition, disrupting the availability of the LDAP service.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official patch or update to the fixed version of OpenLDAP.
Conclusion
The integer underflow vulnerability in OpenLDAP can result in a denial of service attack. It is recommended to update OpenLDAP to version 2.4.57 or later to mitigate this vulnerability. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the LDAP protocol, used for managing user information and providing authentication and authorization services.
The vulnerability can lead to a denial of service (DoS) attack, causing the LDAP service to crash and become unavailable.
To fix this vulnerability, update OpenLDAP to version 2.4.57 or later, which includes a patch for the integer underflow issue.
No, there is no known workaround. It is crucial to update OpenLDAP to the fixed version.
You can find more information about this vulnerability in the CVE-2020-36228 advisory and the provided database-specific source link.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
