CVE-2020-25692
HighCVSS 7.5Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.
Risk Assessment
This can lead to denial of service.
Recommendation
Update OpenLDAP to version 2.4.55 or later.
Other vulnerabilities in OpenLDAP
See all- CVE-2020-36230High
A flaw in OpenLDAP before 2.4.57 leads to an assertion failure in slapd during X.509 DN parsing in decode.c (ber_next_element), resulting in denial of service.
- CVE-2020-36229High
A flaw was discovered in OpenLDAP before 2.4.57 in ldap_X509dn2bv leading to a slapd crash in X.509 DN parsing in ad_keystring, resulting in denial of service.
- CVE-2020-36228High
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting in denial of service.
- CVE-2020-36227High
A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service.
- CVE-2020-36226High
A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.
- CVE-2020-36225High
A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service.
- CVE-2020-36224High
A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.
- CVE-2020-36223High
A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read).
- CVE-2020-36222High
A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.
- CVE-2020-36221High
An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck).
Original NVD description (English source)
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS