Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2020-36224: OpenLDAP Crash Risk: Unauthenticated Denial of Service

CVE-2020-36224 · published 5 years ago

Summary

OpenLDAP servers are at risk of crashing when processing certain authentication requests, which could disrupt service and impact business operations. This is a serious issue because it can cause the server to stop working, affecting users and customers. To mitigate this risk, consider updating to the latest version of OpenLDAP, version 2.4.57 or later.

What to do

Update openldap openldap to version 2.4.57 or later.
Update apple mac_os_x to version 10.14.6 or later.
Update apple macos to version 11.4 or later.

Affected software

Vendor	Product	Affected versions
openldap	openldap	< 2.4.57 `cpe:2.3:a:openldap:openldap::::::::`
debian	debian_linux	9.0 10.0 `cpe:2.3:o:debian:debian_linux:9.0:::::::*`
apple	mac_os_x	>= 10.14.0, < 10.14.6 10.14.6 `cpe:2.3:o:apple:mac_os_x::::::::`
apple	macos	>= 11.1, < 11.4 `cpe:2.3:o:apple:macos::::::::`

Original advisory text

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

References

https://support.apple.com/kb/HT212529 Vendor Advisory
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e3... URL
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8... URL
http://seclists.org/fulldisclosure/2021/May/64 Vendor Advisory
http://seclists.org/fulldisclosure/2021/May/65 Vendor Advisory
http://seclists.org/fulldisclosure/2021/May/70 Vendor Advisory
https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 Vendor Advisory
https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html Vendor Advisory
https://security.netapp.com/advisory/ntap-20210226-0002/ Vendor Advisory
https://support.apple.com/kb/HT212530 Vendor Advisory
https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68... Patch
https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8... Patch
https://support.apple.com/kb/HT212531 Vendor Advisory
https://www.debian.org/security/2021/dsa-4845 Vendor Advisory
https://bugs.openldap.org/show_bug.cgi?id=9409 Third Party Advisory
https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c9... Patch
https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e... Patch

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

7.5 High

Exploitation

4% chance of attack within 30 days

Type

CWE-763Release of Invalid Pointer or Reference

Timeline

Published26 Jan 2021

Updated31 Oct 2026

First seen2 Apr 2026

Sources

CVE-2020-36224 · OSV

CVE-2020-36224 · NVD

CVE-2020-36224 · MITRE

Track software like this

Free during beta