CVE-2020-36224CWE-763

CVE-2020-36224

High · published January 26, 2021

CVSS v3.1
7.5
EPSS
4%
Percentile
91.2
In the wild
Unconfirmed
What it is

A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.04352 · 91.2th percentile
Weakness
CWE-763 · Release of Invalid Pointer or Reference
Published
2021-01-26T23:15Z
Affected products (22)
ProductVersionsFixed in
openldap/openldap< 2.4.572.4.57
debian/debian_linuxall versions—
debian/debian_linuxall versions—
apple/mac_os_x≥ 10.14.0, < 10.14.610.14.6
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/mac_os_xall versions—
apple/macos≥ 11.1, < 11.411.4
References (35)
https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 · af854a3a-2127-422b-91ae-364da2661108https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 · af854a3a-2127-422b-91ae-364da2661108https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20210226-0002/ · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT212529 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT212530 · af854a3a-2127-422b-91ae-364da2661108https://support.apple.com/kb/HT212531 · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2021/dsa-4845 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5ehttp://seclists.org/fulldisclosure/2021/May/64 · [email protected]http://seclists.org/fulldisclosure/2021/May/65 · [email protected]http://seclists.org/fulldisclosure/2021/May/70 · [email protected]https://bugs.openldap.org/show_bug.cgi?id=9409 · [email protected]https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 · [email protected]https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 · [email protected]https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 · [email protected]https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 · [email protected]https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 · [email protected]https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E · [email protected]https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html · [email protected]https://security.netapp.com/advisory/ntap-20210226-0002/ · [email protected]https://support.apple.com/kb/HT212529 · [email protected]https://support.apple.com/kb/HT212530 · [email protected]https://support.apple.com/kb/HT212531 · [email protected]https://www.debian.org/security/2021/dsa-4845 · [email protected]http://seclists.org/fulldisclosure/2021/May/64 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2021/May/65 · af854a3a-2127-422b-91ae-364da2661108http://seclists.org/fulldisclosure/2021/May/70 · af854a3a-2127-422b-91ae-364da2661108https://bugs.openldap.org/show_bug.cgi?id=9409 · af854a3a-2127-422b-91ae-364da2661108https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 · af854a3a-2127-422b-91ae-364da2661108https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 · af854a3a-2127-422b-91ae-364da2661108
EPSS history
Timeline
  • 25 JAN 09:44Z
    A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of…
    cvelistv5