Bugzilla – Bug 1178387
VUL-0: CVE-2020-25692: openldap2: vulnerability with slapd normalization handling with modrdn
Last modified: 2020-12-02 08:35:40 UTC
CVE-2020-25692 A vulnerability in the handling of normalization with modrdn was discovered in OpenLDAP, a free implementation of the Lightweight Directory Access Protocol. An unauthenticated remote attacker can use this flaw to cause a denial of service (slapd daemon crash) via a specially crafted packet. For the stable distribution (buster), this problem has been fixed in version 2.4.47+dfsg-3+deb10u3. We recommend that you upgrade your openldap packages. For the detailed security status of openldap please refer to its security tracker page at: \ https://security-tracker.debian.org/tracker/openldap References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-25692 http://www.debian.org/security/-1/dsa-4782 https://git.openldap.org/openldap/openldap/-/commit/4c774220a752bf8e3284984890dc0931fe73165d
tracking as affected: - SUSE:SLE-11-SP1:Update/openldap2 - SUSE:SLE-11-SP3:Update/openldap2 - SUSE:SLE-12:Update/openldap2 - SUSE:SLE-12-SP2:Update/openldap2 - SUSE:SLE-15:Update/openldap2
SUSE-SU-2020:14541-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1178387 CVE References: CVE-2020-25692 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): openldap2-2.4.26-0.74.16.1, openldap2-client-2.4.26-0.74.16.1 SUSE Linux Enterprise Server 11-SECURITY (src): openldap2-client-openssl1-2.4.26-0.74.16.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): openldap2-2.4.26-0.74.16.1, openldap2-client-2.4.26-0.74.16.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): openldap2-2.4.26-0.74.16.1, openldap2-client-2.4.26-0.74.16.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:3315-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1178387 CVE References: CVE-2020-25692 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 12-SP5 (src): openldap2-2.4.41-18.24.23.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openldap2-2.4.41-18.24.23.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): openldap2-2.4.41-18.24.23.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): openldap2-2.4.41-18.24.23.1 SUSE Linux Enterprise Module for Legacy Software 12 (src): openldap2-2.4.41-18.24.23.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:3313-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1178387 CVE References: CVE-2020-25692 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 15 (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise Server 15-LTSS (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise Module for Legacy Software 15-SP2 (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise Module for Legacy Software 15-SP1 (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise Module for Development Tools 15-SP1 (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise Module for Basesystem 15-SP1 (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): openldap2-2.4.46-9.40.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): openldap2-2.4.46-9.40.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2020:3314-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1178387 CVE References: CVE-2020-25692 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): openldap2-2.4.41-18.77.1 SUSE OpenStack Cloud Crowbar 8 (src): openldap2-2.4.41-18.77.1 SUSE OpenStack Cloud 9 (src): openldap2-2.4.41-18.77.1 SUSE OpenStack Cloud 8 (src): openldap2-2.4.41-18.77.1 SUSE OpenStack Cloud 7 (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server 12-SP5 (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): openldap2-2.4.41-18.77.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): openldap2-2.4.41-18.77.1 SUSE Enterprise Storage 5 (src): openldap2-2.4.41-18.77.1 HPE Helion Openstack 8 (src): openldap2-2.4.41-18.77.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2020:1920-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1178387 CVE References: CVE-2020-25692 JIRA References: Sources used: openSUSE Leap 15.1 (src): openldap2-2.4.46-lp151.10.21.1
openSUSE-SU-2020:1918-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1178387 CVE References: CVE-2020-25692 JIRA References: Sources used: openSUSE Leap 15.2 (src): openldap2-2.4.46-lp152.14.12.1
Hi Support, I have a customer who are focus on this CVE. When will it be merged into SLES11sp3 and SLES11sp1? Thanks.
As the changes for 11SP1 and 11SP3 have been merged/accepted, the question of when it will be available is up to the release management/security team. Marking them as needinfo so they can answer this for you.
All released