Denial of Service Vulnerability in python-ldap: Regex Parsing Flaw
Summary
CVE-2021-46823: python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. Affects python-ldap versions < 47975ee75c84748abfb8bb7456d5cc0a34cfce41. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
python-ldap is a popular library in Python that provides an interface to the Lightweight Directory Access Protocol (LDAP). It is widely used for managing and accessing directory services. The library allows developers to integrate LDAP functionalities into their applications, enabling user authentication, directory browsing, and more. However, prior to version 3.4.0, python-ldap contained a vulnerability that could be exploited through untrusted schema definitions, leading to potential denial of service conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2021-46823, arises from a regular expression denial of service (ReDoS) flaw in the LDAP schema parser of python-ldap. When untrusted schema definitions are processed, an attacker can send specially crafted regex input that causes excessive backtracking in the regex engine. This can lead to significant delays or crashes in the application, effectively resulting in a denial of service. The vulnerability requires remote authenticated access, meaning that an attacker must have some level of access to the system to exploit it.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If upgrading is not immediately possible, a temporary workaround is to avoid using untrusted schema definitions in your application. Ensure that any schema definitions processed by python-ldap are from trusted sources only, which can help mitigate the risk of exploitation until an upgrade can be performed.
Conclusion
CVE-2021-46823 is a significant vulnerability in the python-ldap library that can lead to denial of service through regex parsing flaws. Users are strongly advised to upgrade to version 3.4.0 or later to mitigate this risk. Additionally, using trusted schema definitions can help reduce the likelihood of exploitation until an upgrade is feasible.
See every vulnerability recorded for python-ldap →
FAQ
CVE-2021-46823 is a vulnerability in python-ldap that allows for denial of service through crafted regex input in the LDAP schema parser.
The vulnerability can be exploited by remote authenticated attackers who can send specially crafted input to the LDAP schema parser.
Exploitation of this vulnerability can lead to denial of service, causing the application to become unresponsive or crash.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without needing to sign up.
The CVSS score of CVE-2021-46823 is 6.5, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for python-ldap.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
