CVE-2020-25710

Name
CVE-2020-25710
Description
A flaw was found in OpenLDAP in versions before 2.4.56. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability.
NVD Severity
medium
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
MLIST https://lists.debian.org/debian-lts-announce/2020/12/msg00008.html
MISC https://git.openldap.org/openldap/openldap/-/commit/ab3915154e69920d480205b4bf5ccb2b391a0a1f#a2feb6ed0257c21c6672793ee2f94eaadc10c72c
DEBIAN https://www.debian.org/security/2020/dsa-4792
MISC https://bugzilla.redhat.com/show_bug.cgi?id=1899678
Mailing List https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E
Mailing List https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E
Third Party Advisory https://security.netapp.com/advisory/ntap-20210716-0003/

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:* openldap >= None < 2.4.56

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
openldap edge-main 2.4.56-r0 None fixed
openldap edge-main 2.4.50-r0 None possibly vulnerable
openldap edge-main 2.4.48-r0 None possibly vulnerable
openldap edge-main 2.4.46-r0 None possibly vulnerable
openldap edge-main 2.4.44-r5 None possibly vulnerable
openldap 3.22-main 2.4.56-r0 None fixed
openldap 3.22-main 2.4.50-r0 None possibly vulnerable
openldap 3.22-main 2.4.48-r0 None possibly vulnerable
openldap 3.22-main 2.4.46-r0 None possibly vulnerable
openldap 3.22-main 2.4.44-r5 None possibly vulnerable
openldap 3.21-main 2.4.56-r0 None fixed
openldap 3.21-main 2.4.50-r0 None possibly vulnerable
openldap 3.21-main 2.4.48-r0 None possibly vulnerable
openldap 3.21-main 2.4.46-r0 None possibly vulnerable
openldap 3.21-main 2.4.44-r5 None possibly vulnerable
openldap 3.20-main 2.4.56-r0 None fixed
openldap 3.20-main 2.4.50-r0 None possibly vulnerable
openldap 3.20-main 2.4.48-r0 None possibly vulnerable
openldap 3.20-main 2.4.46-r0 None possibly vulnerable
openldap 3.20-main 2.4.44-r5 None possibly vulnerable
openldap 3.19-main 2.4.56-r0 None fixed
openldap 3.19-main 2.4.50-r0 None possibly vulnerable
openldap 3.19-main 2.4.48-r0 None possibly vulnerable
openldap 3.19-main 2.4.46-r0 None possibly vulnerable
openldap 3.19-main 2.4.44-r5 None possibly vulnerable
openldap 3.18-main 2.4.56-r0 None fixed
openldap 3.17-main 2.4.56-r0 None fixed
openldap 3.12-main 2.4.50-r2 Natanael Copa <ncopa@alpinelinux.org> fixed
openldap 3.12-main 2.4.50-r1 None fixed
openldap 3.11-main 2.4.48-r3 Natanael Copa <ncopa@alpinelinux.org> fixed
openldap 3.10-main 2.4.48-r2 Natanael Copa <ncopa@alpinelinux.org> fixed