Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-25692: OpenLDAP Server Can Be Crashed by Malicious Request

CVE-2020-25692 · published 5 years ago

Summary

An attacker can crash the OpenLDAP server by sending a specially crafted request. This can cause the server to become unavailable. To protect your system, update to OpenLDAP version 2.4.55 or later.

What to do

Update openldap openldap to version 2.4.55 or later.

Affected software

Vendor	Product	Affected versions
openldap	openldap	< 2.4.55 `cpe:2.3:a:openldap:openldap::::::::`
redhat	enterprise_linux	5.0 6.0 7.0 `cpe:2.3:o:redhat:enterprise_linux:5.0:::::::*`
netapp	cloud_backup	All versions `cpe:2.3:a:netapp:cloud_backup:-:::::::*`
netapp	solidfire_baseboard_management_controller_firmware	All versions `cpe:2.3:o:netapp:solidfire_baseboard_management_controller_firmware:-:::::::*`
–	openldap	openldap 2.4.55

Original advisory text

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by s...

References

https://bugzilla.redhat.com/show_bug.cgi?id=1894567 Issue Tracking Patch Third Party Advisory
https://security.netapp.com/advisory/ntap-20210108-0006/ Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

3% chance of attack within 30 days

Type

CWE-476NULL Pointer Dereference

Timeline

Published8 Dec 2020

Updated31 Oct 2026

First seen13 Jul 2026

Sources

CVE-2020-25692 · OSV

CVE-2020-25692 · NVD

CVE-2020-25692 · MITRE

Track software like this

Free during beta