OpenLDAP Denial of Service Vulnerability (CVE-2020-36229)
Summary
CVE-2020-36229: A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. Affects openldap across 2 version ranges.
< 2.4.57-r0
< 3b03d6bea27f29b7f7f91b3d5488fbd6e69b6c29
Fixed in 2.4.57-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) that provides a directory service for managing and accessing distributed directory information. It is widely used for authentication, authorization, and other directory-related services. The vulnerability identified as CVE-2020-36229 affects OpenLDAP versions prior to 2.4.57. This vulnerability can lead to a denial of service (DoS) attack due to a crash in the X.509 DN parsing in ad_keystring.
Vulnerability Detail
The vulnerability arises from a flaw in the ldap_X509dn2bv function in OpenLDAP. When parsing X.509 Distinguished Name (DN) strings, specifically in the ad_keystring function, a crash can occur, resulting in a DoS condition. An attacker can exploit this vulnerability by sending a specially crafted X.509 DN string to the OpenLDAP server, causing it to crash and become unresponsive. This can lead to service disruption and impact the availability of the LDAP directory service.
How To Fix
Minimum fixed version
2.4.57-r0
This is the first release that contains the fix.
sudo apk add --upgrade openldapTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the official fix by upgrading to OpenLDAP version 2.4.57 or later.
Conclusion
The OpenLDAP Denial of Service Vulnerability (CVE-2020-36229) can be mitigated by upgrading to OpenLDAP version 2.4.57 or later. This fix addresses the flaw in the X.509 DN parsing, preventing potential crashes and denial of service attacks. It is recommended to promptly update OpenLDAP installations to ensure the security and availability of LDAP directory services. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for openldap →
FAQ
OpenLDAP is an open-source implementation of the Lightweight Directory Access Protocol (LDAP) used for managing directory services.
The vulnerability can lead to a denial of service (DoS) attack, causing the OpenLDAP server to crash and become unresponsive.
An attacker can exploit this vulnerability by sending a specially crafted X.509 DN string to the OpenLDAP server.
Yes, upgrading OpenLDAP to version 2.4.57 or later will fix this vulnerability.
No, there are no known workarounds. It is crucial to apply the official fix by upgrading OpenLDAP.
Related vulnerabilities
Recent vulnerabilities recorded for openldap.
