Reachable Assertion in OpenLDAP - CVE-2021-27212

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU50779

Reachable Assertion in OpenLDAP - CVE-2021-27212

Published: February 17, 2021 / Updated: March 23, 2021


Vulnerability identifier: #VU50779
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-27212
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when processing LDAP packets within the issuerAndThisUpdateCheck() function in  schema_init.c. A remote attacker can send a specially crafted packet with a short timestamp to the slapd and perform a denial of service (DoS) attack.


Affected software

OpenLDAP
Amazon Linux AMI
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud
HPE Helion Openstack
SUSE OpenStack Cloud Crowbar
SUSE Linux Enterprise Server
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Basesystem
openEuler
openldap (Debian package)
openldap (Alpine package)
openldap2-ppolicy-check-password-debuginfo
openldap2-ppolicy-check-password
compat-libldap-2_3-0
compat-libldap-2_3-0-debuginfo
openldap2-client-openssl1-debugsource
openldap2-client-openssl1-debuginfo
openldap2-debugsource
openldap2-debuginfo
openldap2-client-debugsource
openldap2-client-debuginfo
libldap-openssl1-2_4-2-x86
libldap-openssl1-2_4-2-32bit
openldap2-openssl1
openldap2-client-openssl1
libldap-openssl1-2_4-2
libldap-2_4-2-32bit
openldap2-client
openldap2-back-meta
openldap2
libldap-2_4-2
openldap (Ubuntu package)
openldap
openldap2-back-perl-debuginfo
openldap2-back-perl
openldap2-devel
openldap2-devel-static
openldap2-back-meta-debuginfo
libldap-2_4-2-debuginfo-32bit
libldap-2_4-2-debuginfo
openldap2-doc
slapd (Ubuntu package)
libldap-data
libldap-2_4-2-32bit-debuginfo
openldap2-devel-32bit
openldap-help
openldap-servers
openldap-clients
openldap-debugsource
openldap-debuginfo
openldap-devel
Splunk Enterprise
Dell EMC Unity XT Operating Environment (OE)
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
App Connect Enterprise Certified Container
Dell EMC VxRail Appliance

How to mitigate CVE-2021-27212

Install update from vendor's website.

OpenLDAP - update to 2.4.58
openldap (Debian package) - update to 2.4.47+dfsg-3+deb10u6
openldap (Alpine package) - addressed in versions 2.4.50-r2, 2.4.57-r1
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
openldap2-ppolicy-check-password-debuginfo - addressed in versions 1.2-9.48.1, 1.2-18.83.1
openldap2-ppolicy-check-password - addressed in versions 1.2-9.48.1, 1.2-18.83.1
compat-libldap-2_3-0 - addressed in versions 2.3.37-2.74.26.1, 2.3.37-39.1
compat-libldap-2_3-0-debuginfo - update to 2.3.37-39.1
openldap2-client-openssl1-debugsource - update to 2.4.26-0.74.26.1
openldap2-client-openssl1-debuginfo - update to 2.4.26-0.74.26.1
openldap2-debugsource - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-debuginfo - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-client-debugsource - update to 2.4.26-0.74.26.1
openldap2-client-debuginfo - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
libldap-openssl1-2_4-2-x86 - update to 2.4.26-0.74.26.1
libldap-openssl1-2_4-2-32bit - update to 2.4.26-0.74.26.1
openldap2-openssl1 - update to 2.4.26-0.74.26.1
openldap2-client-openssl1 - update to 2.4.26-0.74.26.1
libldap-openssl1-2_4-2 - update to 2.4.26-0.74.26.1
libldap-2_4-2-32bit - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-client - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-back-meta - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2 - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
libldap-2_4-2 - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap (Ubuntu package) - update to 2.4.31-1+nmu2ubuntu8.5+esm8
openldap - addressed in versions 2.4.40-16.36, 2.4.57-6
openldap2-back-perl-debuginfo - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-back-perl - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-devel - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-devel-static - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-back-meta-debuginfo - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
libldap-2_4-2-debuginfo-32bit - update to 2.4.41-18.83.1
libldap-2_4-2-debuginfo - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-doc - update to 2.4.41-18.83.1
slapd (Ubuntu package) - addressed in versions 2.4.42+dfsg-2ubuntu3.13, 2.4.45+dfsg-1ubuntu1.10, 2.4.49+dfsg-2ubuntu1.7, 2.4.53+dfsg-1ubuntu1.4
libldap-data - update to 2.4.46-9.48.1
libldap-2_4-2-32bit-debuginfo - update to 2.4.46-9.48.1
openldap2-devel-32bit - update to 2.4.46-9.48.1
openldap-help - update to 2.4.50-4
openldap-servers - update to 2.4.50-4
openldap-clients - update to 2.4.50-4
openldap-debugsource - update to 2.4.50-4
openldap-debuginfo - update to 2.4.50-4
openldap - update to 2.4.50-4
openldap-devel - update to 2.4.50-4
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007
App Connect Enterprise Certified Container - update to 7.0.0
Dell EMC VxRail Appliance - update to 7.0.240

External References

Related Security Bulletins