Log in Start free

Vulnerability · Published May 30, 2023 · Assigned by redhat

CVE-2023-2953

High 7.5

In plain English

A high-severity null pointer dereference in openldap. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.0% (higher than 81% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High
Exploit odds (30 days)2.0%top 19.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:8openldap2.4.46-19.el8_10ALSA-2024:4264
AlmaLinux:8openldap-clients2.4.46-19.el8_10ALSA-2024:4264
AlmaLinux:8openldap-devel2.4.46-19.el8_10ALSA-2024:4264
AlmaLinux:8openldap-servers2.4.46-19.el8_10ALSA-2024:4264
Debian:12openldapno fix listedDEBIAN-CVE-2023-2953
Debian:13openldap2.5.16+dfsg-1DEBIAN-CVE-2023-2953
Debian:14openldap2.5.16+dfsg-1DEBIAN-CVE-2023-2953
Rocky Linux:8openldap0:2.4.46-19.el8_10RLSA-2024:4264
Ubuntu:22.04:LTSopenldap2.5.16+dfsg-0ubuntu0.22.04.2UBUNTU-CVE-2023-2953
Ubuntu:22.04:LTSopenldap2.5.16+dfsg-0ubuntu0.22.04.2USN-6616-1

Affected products (as reported)

VendorProductVersions
n/a openldap openldap-2.4

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References