Vulnerability · Published Jan 25, 2021 · Assigned by mitre
CVE-2020-36226
High 7.5
In plain English
A high-severity security flaw in the openldap package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 4.2% (higher than 91% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS NVD)7.5High
Exploit odds (30 days)4.2%top 8.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | openldap | 2.4.57-r0 | ALPINE-CVE-2020-36226 |
| Alpine:v3.21 | openldap | 2.4.57-r0 | ALPINE-CVE-2020-36226 |
| Alpine:v3.22 | openldap | 2.4.57-r0 | ALPINE-CVE-2020-36226 |
| Alpine:v3.23 | openldap | 2.4.57-r0 | ALPINE-CVE-2020-36226 |
| Alpine:v3.24 | openldap | 2.4.57-r0 | ALPINE-CVE-2020-36226 |
| Debian:12 | openldap | 2.4.57+dfsg-1 | DEBIAN-CVE-2020-36226 |
| Debian:13 | openldap | 2.4.57+dfsg-1 | DEBIAN-CVE-2020-36226 |
| Debian:14 | openldap | 2.4.57+dfsg-1 | DEBIAN-CVE-2020-36226 |
Affected products (as reported)
References
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 x_refsource_MISC
- https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 x_refsource_MISC
- https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 x_refsource_MISC
- https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 x_refsource_MISC
- https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 x_refsource_MISC
- https://bugs.openldap.org/show_bug.cgi?id=9413 x_refsource_MISC
- [debian-lts-announce] 20210203 [SECURITY] [DLA 2544-1] openldap security update mailing-list, x_refsource_MLIST
- DSA-4845 vendor-advisory, x_refsource_DEBIAN
- https://security.netapp.com/advisory/ntap-20210226-0002/ x_refsource_CONFIRM
- https://support.apple.com/kb/HT212529 x_refsource_CONFIRM
- https://support.apple.com/kb/HT212531 x_refsource_CONFIRM
- https://support.apple.com/kb/HT212530 x_refsource_CONFIRM
- 20210526 APPLE-SA-2021-05-25-2 macOS Big Sur 11.4 mailing-list, x_refsource_FULLDISC
- 20210526 APPLE-SA-2021-05-25-4 Security Update 2021-003 Catalina mailing-list, x_refsource_FULLDISC
- 20210526 APPLE-SA-2021-05-25-3 Security Update 2021-004 Mojave mailing-list, x_refsource_FULLDISC
- [guacamole-issues] 20210618 [jira] [Created] (GUACAMOLE-1368) Latest docker image fails security scans. mailing-list, x_refsource_MLIST
- [bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list, x_refsource_MLIST
- [bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8 mailing-list, x_refsource_MLIST
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html