Bug 1894567 (CVE-2020-25692)

Summary: CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd
Product: [Other] Security Response Reporter: Guilherme de Almeida Suckevicz <gsuckevi>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: aboyko, apeddire, asoldano, atangrin, bbaranow, bmaxwell, brian.stansberry, cbuissar, cdewolf, chazlett, csutherl, darran.lofthouse, dkreling, dosoudil, eleandro, gzaronik, iweiss, jawilson, jclere, jochrist, jperkins, jwon, krathod, kwills, lgao, matushonek, mbabacek, mharmsen, msalle, msochure, msvehla, mturk, myarboro, nwallace, pjindal, pmackay, rguimara, rmeggins, rstancel, rsvoboda, scorneli, smaestri, spichugi, tom.jenkinson, vashirov, weli
Target Milestone: ---Keywords: Security
Target Release: ---Flags: spichugi: needinfo-
Hardware: All   
OS: Linux   
Fixed In Version: openldap 2.4.55 Doc Type: If docs needed, set a value
Doc Text:
A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker to crash the slapd process by sending a specially crafted request, causing a denial of service. The highest threat from this vulnerability is to system availability.
Story Points: ---
Clone Of: Environment:
Last Closed: 2021-04-27 16:46:34 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 1895288, 1895328    
Bug Blocks: 1894568    

Description Guilherme de Almeida Suckevicz 2020-11-04 14:09:18 UTC
OpenLDAP slapd crashes on what seems to be a null-ptr-dereference after receiving a malicious TCP packet.


Comment 1 Cedric Buissart 2020-11-06 08:47:35 UTC
Created openldap tracking bugs for this issue:

Affects: fedora-all [bug 1895288]

Comment 6 RaTasha Tillery-Smith 2020-12-08 15:55:26 UTC

This vulnerability affects the server side only. As a result, OpenLDAP client components, such as the component shipped in Red Hat Enterprise Linux 8, are not affected by this flaw.

Comment 10 errata-xmlrpc 2021-04-27 11:33:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2021:1389 https://access.redhat.com/errata/RHSA-2021:1389

Comment 11 Product Security DevOps Team 2021-04-27 16:46:34 UTC
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):