IM
IronMonkey Threat Research

CVE-2020-12243 HIGH

Published: 2020-04-28 | Last Modified: 2024-11-21 | Status: Modified

Description

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Additional Descriptions (1)

En el archivo filter.c en slapd en OpenLDAP versiones anteriores a 2.4.50, los filtros de búsqueda de LDAP con expresiones booleanas anidadas pueden resultar en una denegación de servicio (bloqueo del demonio).

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-674

Affected Products

Vendor Product Version Update Type
openldap openldap * <built-in method update of dict object at 0x72a961ec9b00> Application
debian debian_linux 8.0 <built-in method update of dict object at 0x72a961ecbe00> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x72a961ecac00> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x72a961eca580> Operating System
opensuse leap 15.1 <built-in method update of dict object at 0x72a961eca180> Operating System
canonical ubuntu_linux 12.04 <built-in method update of dict object at 0x72a961ecb6c0> Operating System
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x72a961ec8dc0> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x72a961ec8400> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x72a963c6bc40> Operating System
canonical ubuntu_linux 19.10 <built-in method update of dict object at 0x72a961ecb940> Operating System
canonical ubuntu_linux 20.04 <built-in method update of dict object at 0x72a963c6bc80> Operating System
netapp cloud_backup - <built-in method update of dict object at 0x72a961ec8480> Application
netapp steelstore_cloud_integrated_storage - <built-in method update of dict object at 0x72a9b0cf9500> Application
netapp h410c_firmware - <built-in method update of dict object at 0x72a961ec8100> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x72a961ecb840> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x72a961ec8cc0> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x72a961ecaac0> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x72a9cd08cd80> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x72a961ec9f40> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x72a961ec9600> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x72a961ec8740> Operating System
broadcom brocade_fabric_operating_system - <built-in method update of dict object at 0x72a961ecaf80> Operating System
apple mac_os_x * <built-in method update of dict object at 0x72a963c6b200> Operating System
apple mac_os_x * <built-in method update of dict object at 0x72a961ecbf40> Operating System
apple mac_os_x * <built-in method update of dict object at 0x72a961ec9c80> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a9cd08eec0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a961ecad00> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a961ec9480> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a963c6be40> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a963c6ba40> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a963c68fc0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a963c6a980> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a999778a00> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a99977a800> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a949bed5c0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a949bed180> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a949bed3c0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x72a949becf80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bed1c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949becd80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949becfc0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949becb80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bed780> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bedbc0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bed980> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949beddc0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bedb80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bedfc0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bedd80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bee1c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bedf80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bee3c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bee180> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bee5c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bee380> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x72a949bee7c0> Operating System
oracle zfs_storage_appliance_kit 8.8 <built-in method update of dict object at 0x72a949bee580> Application
oracle solaris 10 <built-in method update of dict object at 0x72a949bee9c0> Operating System
oracle solaris 11 <built-in method update of dict object at 0x72a949bee780> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:brocade_fabric_operating_system:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:supplemental_update:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
Yes cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*

References

Notification
Message here