Vulnerability CVE-2020-12243: Information

Description

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

URL: https://nvd.nist.gov/vuln/detail/CVE-2020-12243
Published: April 28, 2020
Modified: April 29, 2022
Error type identifier: CWE-674

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
openldapsisyphus2.4.54-alt12.6.7-alt2ALT-PU-2020-3121-1260267Fixed
openldapp102.4.54-alt12.4.59-alt1.p10.2ALT-PU-2020-3121-1260267Fixed
openldapp92.4.54-alt0.M90P.12.4.59-alt0.p9.1ALT-PU-2020-3151-1260357Fixed
openldapc10f12.4.54-alt12.4.59-alt1.p10.2ALT-PU-2020-3121-1260267Fixed
openldapc9f22.4.54-alt0.M90P.12.4.59-alt0.c9.2ALT-PU-2020-3190-1260358Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES
  • Release Notes
  • Vendor Advisory
https://bugs.openldap.org/show_bug.cgi?id=9202
  • Exploit
  • Patch
  • Vendor Advisory
https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440
  • Patch
  • Vendor Advisory
DSA-4666
  • Third Party Advisory
[debian-lts-announce] 20200502 [SECURITY] [DLA 2199-1] openldap security update
  • Mailing List
  • Third Party Advisory
USN-4352-2
  • Third Party Advisory
https://security.netapp.com/advisory/ntap-20200511-0003/
  • Third Party Advisory
openSUSE-SU-2020:0647
  • Mailing List
  • Third Party Advisory
USN-4352-1
  • Third Party Advisory
https://support.apple.com/kb/HT211289
  • Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html
  • Patch
  • Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html
  • Third Party Advisory

    1. Configuration 1

      cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*
      End excliding
      2.4.50

      Configuration 2

      cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
      cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

      Configuration 3

      cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

      Configuration 4

      cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
      cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*

      Configuration 5

      cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
      cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

      Configuration 6

      cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

      Configuration 7

      cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

      Configuration 8

      cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

      Configuration 9

      cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

      Configuration 10

      cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

      Configuration 11

      cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

      Configuration 12

      cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

      Configuration 13

      cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
      Running on/with:
      cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

      Configuration 14

      cpe:2.3:o:broadcom:brocade_fabric_operating_system:-:*:*:*:*:*:*:*

      Configuration 15

      cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
      Start including
      10.13.0
      End excliding
      10.13.6
      cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
      Start including
      10.14.0
      End excliding
      10.14.6
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
      Start including
      10.15
      End excliding
      10.15.6
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-003:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:supplemental_update:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*
      cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-003:*:*:*:*:*:*

      Configuration 16

      cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*
      cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
      cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
Version: v24.5.1
Back to top