CVSS: 7.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-25692 – openldap: NULL pointer dereference for unauthenticated packet in slapd
https://notcve.org/view.php?id=CVE-2020-25692
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service. Se encontró una desreferencia de puntero NULL en el servidor OpenLDAP y se corrigió en openldap versión 2.4.55, durante una petición para cambiar el nombre de los RDN. Un atacante no autenticado podría bloquear remotamente el proceso slapd al enviar una petición especialmente diseñada, causando una Denegación de Servicio A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker to crash the slapd process by sending a specially crafted request, causing a denial of service. • https://bugzilla.redhat.com/show_bug.cgi?id=1894567 https://security.netapp.com/advisory/ntap-20210108-0006 https://access.redhat.com/security/cve/CVE-2020-25692 • CWE-476: NULL Pointer Dereference •
CVSS: 4.2EPSS: 0%CPEs: 6EXPL: 0CVE-2020-15719
https://notcve.org/view.php?id=CVE-2020-15719
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux. libldap en determinados paquetes OpenLDAP de terceros presenta un fallo de comprobación de certificados cuando el paquete de terceros está afirmando que admite RFC6125. Considera CN incluso cuando se presenta un subjectAltName (SAN) no coincidente. Esto es corregido, por ejemplo, en la versión openldap-2.4.46-10.el8 en Red Hat Enterprise • http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00033.html http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00059.html https://access.redhat.com/errata/RHBA-2019:3674 https://bugs.openldap.org/show_bug.cgi?id=9266 https://bugzilla.redhat.com/show_bug.cgi?id=1740070 https://kc.mcafee.com/corporate/index?page=content&id=SB10365 https://www.oracle.com/security-alerts/cpuapr2022.html • CWE-295: Improper Certificate Validation •
CVSS: 7.5EPSS: 9%CPEs: 67EXPL: 1CVE-2020-12243 – openldap: denial of service via nested boolean expressions in LDAP search filters
https://notcve.org/view.php?id=CVE-2020-12243
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). En el archivo filter.c en slapd en OpenLDAP versiones anteriores a 2.4.50, los filtros de búsqueda de LDAP con expresiones booleanas anidadas pueden resultar en una denegación de servicio (bloqueo del demonio). • http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html https://bugs.openldap.org/show_bug.cgi?id=9202 https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html https://security.netapp.com/advisory/ntap-20200511-0003 https://support.apple.com/kb/HT211289 https://usn.ubuntu.com/4352-1 https&# • CWE-400: Uncontrolled Resource Consumption CWE-674: Uncontrolled Recursion •
CVSS: 7.5EPSS: 28%CPEs: 4EXPL: 2CVE-2014-8182 – openldap: crash in ldap_domain2hostlist when processing SRV records
https://notcve.org/view.php?id=CVE-2014-8182
An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses. Se descubrió un error por un paso conllevando a un bloqueo en openldap versión 2.4, cuando se procesan mensajes DNS SRV. Si slapd fue configurado para utilizar el backend dnssrv, un atacante podría bloquear el servicio con respuestas DNS especialmente diseñadas. An off-by-one error leading to a crash was discovered in openldap's processing of DNS SRV messages. • https://access.redhat.com/security/cve/cve-2014-8182 https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-8182 https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-8182 https://security-tracker.debian.org/tracker/CVE-2014-8182 https://access.redhat.com/security/cve/CVE-2014-8182 https://bugzilla.redhat.com/show_bug.cgi?id=1095976 • CWE-193: Off-by-one Error •
CVSS: 7.5EPSS: 0%CPEs: 29EXPL: 0CVE-2019-13565
https://notcve.org/view.php?id=CVE-2019-13565
An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained for all new non-SASL connections. Depending on the ACL configuration, this can affect different types of operations (searches, modifications, etc.). In other words, a successful authorization step completed by one user affects the authorization requirement for a different user. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html http://seclists.org/fulldisclosure/2019/Dec/26 https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues. •