Incorrect Regular Expression in python-ldap - CVE-2021-46823

Vulnerability identifier: #VU65120

CSH Severity: Medium

CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-46823

CWE-ID: CWE-185

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient input validation when processing regular expressions in the LDAP schema parser. A remote attacker can pass specially crafted data to the application and perform regular expression denial of service (ReDos) attack.

python-ldap
Ubuntu
openEuler
python3-pyldap (Ubuntu package)
python3-ldap (Ubuntu package)
python-pyldap (Ubuntu package)
python-ldap (Ubuntu package)
python-ldap-help
python3-ldap
python-ldap
HPE Moonshot 1500 Chassis Manager

Install update from vendor's website.

python-ldap - update to 3.4.0
python3-pyldap (Ubuntu package) - addressed in versions 3.0.0-1ubuntu0.2, 3.2.0-4ubuntu2.1, 3.2.0-4ubuntu5.1, 3.2.0-4ubuntu7.1
python3-ldap (Ubuntu package) - addressed in versions 3.0.0-1ubuntu0.2, 3.2.0-4ubuntu2.1, 3.2.0-4ubuntu5.1, 3.2.0-4ubuntu7.1
python-pyldap (Ubuntu package) - update to 3.0.0-1ubuntu0.2
python-ldap (Ubuntu package) - update to 3.0.0-1ubuntu0.2
python-ldap-help - update to 3.1.0-4
python3-ldap - update to 3.1.0-4
python-ldap - update to 3.1.0-4
HPE Moonshot 1500 Chassis Manager - update to 4.0-b43

• https://github.com/python-ldap/python-ldap/security/advisories/GHSA-r8wq-qrxc-hmcm

• Denial of service in python-ldap
• Ubuntu update for python-ldap
• openEuler update for python-ldap
• openEuler 20.03 LTS SP3 update for python-ldap
• Multiple vulnerabilities in HPE Moonshot 1500 Chassis Manager