IM
IronMonkey Threat Research

CVE-2020-36222 HIGH

Published: 2021-01-26 | Last Modified: 2024-11-21 | Status: Modified

Description

A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.

Additional Descriptions (1)

Se detectó un fallo en OpenLDAP versiones anteriores a 2.4.57, conllevando a un fallo de aserción en slapd en la comprobación de saslAuthzTo, resultando en una denegación de servicio

CVSS Metrics

Base Score: 7.5 (HIGH)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 3.6

Base Score: 5.0 (MEDIUM)

AV:N/AC:L/Au:N/C:N/I:N/A:P

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactPARTIAL

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 2.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-617

Affected Products

Vendor Product Version Update Type
openldap openldap * <built-in method update of dict object at 0x7fd38541c440> Application
debian debian_linux 9.0 <built-in method update of dict object at 0x7fd385055fc0> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd2d2496980> Operating System
apple mac_os_x * <built-in method update of dict object at 0x7fd36b156d40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd38541cb80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd38541f480> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945e700> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945f300> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3854be6c0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd38541fc80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd370399a00> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd385056080> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3854be340> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2a2248a80> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd36945ec40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3854bcbc0> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd38541d280> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd2d2497d00> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3854bcc40> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd39c4a6940> Operating System
apple mac_os_x 10.14.6 <built-in method update of dict object at 0x7fd3854bfac0> Operating System
apple macos * <built-in method update of dict object at 0x7fd385057980> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-003:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*
Yes cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*
Yes cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*

References