Bitnami package
openldap
pkg:bitnami/openldap
Vulnerabilities (18)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-2953 | — | >= 2.4.0, < 2.4.1 | 2.4.1 | May 30, 2023 | A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function. | ||
| CVE-2022-29155 | — | >= 2.0.0, < 2.5.12 | 2.5.12 | May 4, 2022 | In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of | ||
| CVE-2020-25710 | — | < 2.4.56 | 2.4.56 | May 28, 2021 | A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability. | ||
| CVE-2020-25709 | — | < 2.4.56 | 2.4.56 | May 18, 2021 | A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability. | ||
| CVE-2021-27212 | — | < 2.4.58 | 2.4.58 | Feb 14, 2021 | In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime. | ||
| CVE-2020-36221 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck). | ||
| CVE-2020-36222 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. | ||
| CVE-2020-36224 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. | ||
| CVE-2020-36225 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. | ||
| CVE-2020-36226 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. | ||
| CVE-2020-36228 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service. | ||
| CVE-2020-36229 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. | ||
| CVE-2020-36230 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. | ||
| CVE-2020-36227 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. | ||
| CVE-2020-36223 | — | < 2.4.57 | 2.4.57 | Jan 25, 2021 | A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read). | ||
| CVE-2020-25692 | — | < 2.4.55 | 2.4.55 | Dec 8, 2020 | A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service. | ||
| CVE-2020-15719 | — | < 2.4.46-10.el8 | 2.4.46-10.el8 | Jul 14, 2020 | libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat E | ||
| CVE-2020-12243 | — | < 2.4.50 | 2.4.50 | Apr 28, 2020 | In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash). |
- CVE-2023-2953May 30, 2023affected >= 2.4.0, < 2.4.1fixed 2.4.1
A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.
- CVE-2022-29155May 4, 2022affected >= 2.0.0, < 2.5.12fixed 2.5.12
In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL statement within an LDAP query. This can occur during an LDAP search operation when the search filter is processed, due to a lack of
- CVE-2020-25710May 28, 2021affected < 2.4.56fixed 2.4.56
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
- CVE-2020-25709May 18, 2021affected < 2.4.56fixed 2.4.56
A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP’s slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.
- CVE-2021-27212Feb 14, 2021affected < 2.4.58fixed 2.4.58
In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.
- CVE-2020-36221Jan 25, 2021affected < 2.4.57fixed 2.4.57
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).
- CVE-2020-36222Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.
- CVE-2020-36224Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.
- CVE-2020-36225Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.
- CVE-2020-36226Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.
- CVE-2020-36228Jan 25, 2021affected < 2.4.57fixed 2.4.57
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.
- CVE-2020-36229Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in denial of service.
- CVE-2020-36230Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service.
- CVE-2020-36227Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.
- CVE-2020-36223Jan 25, 2021affected < 2.4.57fixed 2.4.57
A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).
- CVE-2020-25692Dec 8, 2020affected < 2.4.55fixed 2.4.55
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.
- CVE-2020-15719Jul 14, 2020affected < 2.4.46-10.el8fixed 2.4.46-10.el8
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat E
- CVE-2020-12243Apr 28, 2020affected < 2.4.50fixed 2.4.50
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).