OpenLDAP before 2.4.57 X.509 DN Parsing Assertion Failure
Summary
CVE-2020-36230: A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP). It provides a directory service for managing and accessing distributed directory information. OpenLDAP is widely used in various applications and systems for authentication and authorization purposes. However, versions before 2.4.57 are vulnerable to an assertion failure in the X.509 DN parsing, specifically in the decode.c ber_next_element function. This vulnerability can result in a denial of service.
Vulnerability Detail
The vulnerability in OpenLDAP before 2.4.57 arises from a flaw in the X.509 DN parsing process. When processing X.509 Distinguished Names (DNs), the decode.c ber_next_element function fails to handle certain inputs correctly, leading to an assertion failure in slapd. An attacker can exploit this vulnerability by providing a specially crafted X.509 DN, causing the server to crash and resulting in a denial of service. The impact of this vulnerability is limited to a denial of service, and there is no evidence of it leading to remote code execution or information disclosure.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official fix by updating OpenLDAP to the latest version.
Conclusion
OpenLDAP before 2.4.57 is vulnerable to an assertion failure in the X.509 DN parsing process, which can result in a denial of service. To mitigate this vulnerability, it is crucial to update OpenLDAP to version 2.4.57 or later. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP), providing a directory service for managing and accessing distributed directory information.
The vulnerability in OpenLDAP before 2.4.57 can result in a denial of service, causing the server to crash and become unresponsive.
No, there is no evidence of this vulnerability leading to remote code execution or information disclosure.
To fix this vulnerability, update OpenLDAP to version 2.4.57 or later.
No, there is no known workaround for this vulnerability. It is recommended to apply the official fix by updating OpenLDAP.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
