CVE-2020-12243CWE-674

CVE-2020-12243

High · published April 28, 2020

CVSS v3.1
7.5
EPSS
5%
Percentile
91.8
In the wild
Unconfirmed
What it is

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.04718 · 91.8th percentile
Weakness
CWE-674 · Uncontrolled Recursion
Published
2020-04-28T23:15Z
Affected products (59)
ProductVersionsFixed in
openldap/openldap< 2.4.502.4.50
debian/debian_linuxall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
opensuse/leapall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
canonical/ubuntu_linuxall versions—
netapp/cloud_backupall versions—
netapp/steelstore_cloud_integrated_storageall versions—
netapp/h410c_firmwareall versions—
netapp/h300s_firmwareall versions—
netapp/h500s_firmwareall versions—
netapp/h700s_firmwareall versions—
netapp/h300e_firmwareall versions—
netapp/h500e_firmwareall versions—
netapp/h700e_firmwareall versions—
netapp/h410s_firmwareall versions—
broadcom/brocade_fabric_operating_systemall versions—
apple/mac_os_x≥ 10.13.0, < 10.13.610.13.6
apple/mac_os_x≥ 10.14.0, < 10.14.610.14.6
apple/mac_os_x≥ 10.15, < 10.15.610.15.6
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
oracle/zfs_storage_appliance_kitall versions—
oracle/solarisall versions—
oracle/solarisall versions—
References (25)
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html · [email protected]https://bugs.openldap.org/show_bug.cgi?id=9202 · [email protected]https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES · [email protected]https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 · [email protected]https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html · [email protected]https://security.netapp.com/advisory/ntap-20200511-0003/ · [email protected]https://support.apple.com/kb/HT211289 · [email protected]https://usn.ubuntu.com/4352-1/ · [email protected]https://usn.ubuntu.com/4352-2/ · [email protected]https://www.debian.org/security/2020/dsa-4666 · [email protected]https://www.oracle.com/security-alerts/cpuapr2022.html · [email protected]https://www.oracle.com/security-alerts/cpuoct2020.html · [email protected]http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html · af854a3a-2127-422b-91ae-364da2661108https://bugs.openldap.org/show_bug.cgi?id=9202 · af854a3a-2127-422b-91ae-364da2661108https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES · af854a3a-2127-422b-91ae-364da2661108https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20200511-0003/ · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT211289 · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4352-1/ · af854a3a-2127-422b-91ae-364da2661108https://usn.ubuntu.com/4352-2/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2020/dsa-4666 · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuapr2022.html · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2020.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 28 APR 18:07Z
    In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)
    cvelistv5