IM
IronMonkey Threat Research

CVE-2020-12243 HIGH

Published: 2020-04-28 | Last Modified: 2024-11-21 | Status: Modified

Description

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Additional Descriptions (1)

En el archivo filter.c en slapd en OpenLDAP versiones anteriores a 2.4.50, los filtros de búsqueda de LDAP con expresiones booleanas anidadas pueden resultar en una denegación de servicio (bloqueo del demonio).

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-674

Affected Products

Vendor Product Version Update Type
openldap openldap * <built-in method update of dict object at 0x7fd3855dc780> Application
debian debian_linux 8.0 <built-in method update of dict object at 0x7fd36b57e200> Operating System
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd3855dd4c0> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd3855dc700> Operating System
opensuse leap 15.1 <built-in method update of dict object at 0x7fd3855dd1c0> Operating System
canonical ubuntu_linux 12.04 <built-in method update of dict object at 0x7fd3855dd3c0> Operating System
canonical ubuntu_linux 14.04 <built-in method update of dict object at 0x7fd3855dc600> Operating System
canonical ubuntu_linux 16.04 <built-in method update of dict object at 0x7fd3855dcdc0> Operating System
canonical ubuntu_linux 18.04 <built-in method update of dict object at 0x7fd39c4eb200> Operating System
canonical ubuntu_linux 19.10 <built-in method update of dict object at 0x7fd3855df840> Operating System
canonical ubuntu_linux 20.04 <built-in method update of dict object at 0x7fd38541fac0> Operating System
netapp cloud_backup - <built-in method update of dict object at 0x7fd3855dca80> Application
netapp steelstore_cloud_integrated_storage - <built-in method update of dict object at 0x7fd3855dc1c0> Application
netapp h410c_firmware - <built-in method update of dict object at 0x7fd3855ddb80> Operating System
netapp h300s_firmware - <built-in method update of dict object at 0x7fd3855dfc80> Operating System
netapp h500s_firmware - <built-in method update of dict object at 0x7fd384a20dc0> Operating System
netapp h700s_firmware - <built-in method update of dict object at 0x7fd384dd6a80> Operating System
netapp h300e_firmware - <built-in method update of dict object at 0x7fd370344800> Operating System
netapp h500e_firmware - <built-in method update of dict object at 0x7fd36b2c6140> Operating System
netapp h700e_firmware - <built-in method update of dict object at 0x7fd384dd5040> Operating System
netapp h410s_firmware - <built-in method update of dict object at 0x7fd36afa69c0> Operating System
broadcom brocade_fabric_operating_system - <built-in method update of dict object at 0x7fd36afa5400> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7fd2dbc81b80> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7fd2dbc823c0> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7fd3406e31c0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd2d82a3bc0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd36afa4080> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd2dbd51540> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd319dd4500> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd2dbff5f00> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd319dd7bc0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd39c4e8300> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd38541e780> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd36b2c70c0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd36afa4280> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd36be626c0> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd36be60480> Operating System
apple mac_os_x 10.13.6 <built-in method update of dict object at 0x7fd36be60980> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36be60680> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36be62940> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd38541fd80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbff6c80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36b57c240> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3703bb040> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd39c4ea680> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd319c773c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbc825c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36afa7940> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbd50580> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2dbd51c40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36afa4c40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd39c4e9b80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd39c4eae80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd39c4e9180> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd39c4e8380> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd39c4ebd80> Operating System
oracle zfs_storage_appliance_kit 8.8 <built-in method update of dict object at 0x7fd39c4e9e40> Application
oracle solaris 10 <built-in method update of dict object at 0x7fd2dbd504c0> Operating System
oracle solaris 11 <built-in method update of dict object at 0x7fd2dbd52580> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
Yes cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
Yes cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410c:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h300e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h500e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h700e:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
No cpe:2.3:h:netapp:h410s:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:broadcom:brocade_fabric_operating_system:-:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.13.6:supplemental_update:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:*
Yes cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:*
Yes cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:*

References