Reachable Assertion in OpenLDAP - CVE-2021-27212

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU50779

Reachable Assertion in OpenLDAP - CVE-2021-27212

Published: February 17, 2021 / Updated: March 23, 2021


Vulnerability identifier: #VU50779
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2021-27212
CWE-ID: CWE-617
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a reachable assertion when processing LDAP packets within the issuerAndThisUpdateCheck() function in  schema_init.c. A remote attacker can send a specially crafted packet with a short timestamp to the slapd and perform a denial of service (DoS) attack.


Affected software

OpenLDAP
Amazon Linux AMI
SUSE Manager Server
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE CaaS Platform
SUSE Enterprise Storage
SUSE OpenStack Cloud
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Server
SUSE Linux Enterprise Debuginfo
SUSE Linux Enterprise Point of Sale
SUSE Linux Enterprise Module for Legacy Software
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Software Development Kit
Ubuntu
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
openEuler
Splunk Enterprise
openldap (Alpine package)
openldap (Debian package)
slapd (Ubuntu package)
openldap2-ppolicy-check-password
openldap2-ppolicy-check-password-debuginfo
compat-libldap-2_3-0
compat-libldap-2_3-0-debuginfo
libldap-openssl1-2_4-2-x86
openldap2-client-openssl1-debugsource
openldap2-client-openssl1-debuginfo
openldap2-debugsource
openldap2-debuginfo
openldap2-client-debugsource
openldap2-client-debuginfo
libldap-openssl1-2_4-2-32bit
openldap2-client-openssl1
openldap2-openssl1
libldap-openssl1-2_4-2
libldap-2_4-2-32bit
openldap2-client
openldap2-back-meta
openldap2
libldap-2_4-2
openldap
openldap2-back-perl
openldap2-back-perl-debuginfo
openldap2-devel
openldap2-devel-static
openldap2-back-meta-debuginfo
libldap-2_4-2-debuginfo-32bit
libldap-2_4-2-debuginfo
openldap2-doc
openldap2-devel-32bit
libldap-2_4-2-32bit-debuginfo
libldap-data
openldap-debuginfo
openldap-devel
openldap-clients
openldap-debugsource
openldap-servers
openldap-help
Dell EMC Unity Operating Environment (OE)
Dell EMC Unity VSA Operating Environment (OE)
Dell EMC Unity XT Operating Environment (OE)
App Connect Enterprise Certified Container
Dell EMC VxRail Appliance

How to mitigate CVE-2021-27212

Install update from vendor's website.

OpenLDAP - update to 2.4.58
Splunk Enterprise - addressed in versions 9.1.6, 9.2.3, 9.3.1
openldap (Alpine package) - addressed in versions 2.4.50-r2, 2.4.57-r1
openldap (Debian package) - update to 2.4.47+dfsg-3+deb10u6
slapd (Ubuntu package) - addressed in versions 2.4.31-1+nmu2ubuntu8.5+esm8, 2.4.42+dfsg-2ubuntu3.13, 2.4.45+dfsg-1ubuntu1.10, 2.4.49+dfsg-2ubuntu1.7, 2.4.53+dfsg-1ubuntu1.4
openldap2-ppolicy-check-password - addressed in versions 1.2-9.48.1, 1.2-18.83.1
openldap2-ppolicy-check-password-debuginfo - addressed in versions 1.2-9.48.1, 1.2-18.83.1
compat-libldap-2_3-0 - addressed in versions 2.3.37-2.74.26.1, 2.3.37-39.1
compat-libldap-2_3-0-debuginfo - update to 2.3.37-39.1
libldap-openssl1-2_4-2-x86 - update to 2.4.26-0.74.26.1
openldap2-client-openssl1-debugsource - update to 2.4.26-0.74.26.1
openldap2-client-openssl1-debuginfo - update to 2.4.26-0.74.26.1
openldap2-debugsource - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-debuginfo - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-client-debugsource - update to 2.4.26-0.74.26.1
openldap2-client-debuginfo - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
libldap-openssl1-2_4-2-32bit - update to 2.4.26-0.74.26.1
openldap2-client-openssl1 - update to 2.4.26-0.74.26.1
openldap2-openssl1 - update to 2.4.26-0.74.26.1
libldap-openssl1-2_4-2 - update to 2.4.26-0.74.26.1
libldap-2_4-2-32bit - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-client - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-back-meta - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2 - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
libldap-2_4-2 - addressed in versions 2.4.26-0.74.26.1, 2.4.41-18.83.1, 2.4.46-9.48.1
openldap - addressed in versions 2.4.40-16.36, 2.4.57-6
openldap2-back-perl - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-back-perl-debuginfo - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-devel - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-devel-static - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-back-meta-debuginfo - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
libldap-2_4-2-debuginfo-32bit - update to 2.4.41-18.83.1
libldap-2_4-2-debuginfo - addressed in versions 2.4.41-18.83.1, 2.4.46-9.48.1
openldap2-doc - update to 2.4.41-18.83.1
openldap2-devel-32bit - update to 2.4.46-9.48.1
libldap-2_4-2-32bit-debuginfo - update to 2.4.46-9.48.1
libldap-data - update to 2.4.46-9.48.1
openldap-debuginfo - update to 2.4.50-4
openldap-devel - update to 2.4.50-4
openldap - update to 2.4.50-4
openldap-clients - update to 2.4.50-4
openldap-debugsource - update to 2.4.50-4
openldap-servers - update to 2.4.50-4
openldap-help - update to 2.4.50-4
Dell EMC Unity Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity VSA Operating Environment (OE) - update to 5.1.2.0.5.007
Dell EMC Unity XT Operating Environment (OE) - update to 5.1.2.0.5.007
App Connect Enterprise Certified Container - update to 7.0.0
Dell EMC VxRail Appliance - update to 7.0.240

External References

Related Security Bulletins