CVE-2020-12243

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

• Rebase to 2.4.58 to fix the following vulnerabilities:
• CVE-2020-12243: fix denial of service caused by LDAP search filters with nested boolean expressions
• CVE-2020-36221: fix integer underflow in the Certificate Exact Assertion processing
• CVE-2020-36223: fix slapd crash in the Values Return Filter control handling
• CVE-2020-36226: fix slapd crash in the saslAuthzTo processing
• CVE-2020-36228: fix slapd crash in the Certificate List Exact Assertion processing
• CVE-2020-36225: fix double free and slapd crash in the saslAuthzTo processing
• CVE-2020-36227: fix infinite loop in slapd with the cancel_extop Cancel operation
• CVE-2020-36230: fix assertion failure in slapd in the X.509 DN parsing in decode.c
• CVE-2020-25692: fix NULL pointer dereference during a request for renaming RDNs
• CVE-2020-25709: fix assertion failure caused by processing malicious packet
• CVE-2020-36224: fix invalid pointer free and slapd crash in the saslAuthzTo processing
• CVE-2020-36229: fix slapd crash in the X.509 DN parsing in ad_keystring
• CVE-2020-25710: fix failed assertion in csnNormalize23()
• CVE-2020-36222: fix assertion failure in slapd in the saslAuthzTo validation

• Rebase to 2.4.58 to fix the following vulnerabilities:
• CVE-2020-12243: fix denial of service caused by LDAP search filters with nested boolean expressions
• CVE-2020-36221: fix integer underflow in the Certificate Exact Assertion processing
• CVE-2020-36223: fix slapd crash in the Values Return Filter control handling
• CVE-2020-36226: fix slapd crash in the saslAuthzTo processing
• CVE-2020-36228: fix slapd crash in the Certificate List Exact Assertion processing
• CVE-2020-36225: fix double free and slapd crash in the saslAuthzTo processing
• CVE-2020-36227: fix infinite loop in slapd with the cancel_extop Cancel operation
• CVE-2020-36230: fix assertion failure in slapd in the X.509 DN parsing in decode.c
• CVE-2020-25692: fix NULL pointer dereference during a request for renaming RDNs
• CVE-2020-25709: fix assertion failure caused by processing malicious packet
• CVE-2020-36224: fix invalid pointer free and slapd crash in the saslAuthzTo processing
• CVE-2020-36229: fix slapd crash in the X.509 DN parsing in ad_keystring
• CVE-2020-25710: fix failed assertion in csnNormalize23()
• CVE-2020-36222: fix assertion failure in slapd in the saslAuthzTo validation

• CVE-2019-13565: SASL session encryption SSF not reset on new connection, allowing downgrade
• CVE-2020-12243: slapd crash via deeply nested LDAP search filter boolean expressions
• CVE-2020-25692: NULL pointer dereference in slapd during modRDN request
• CVE-2020-25709: slapd assertion failure via crafted certificate list validation
• CVE-2020-25710: slapd assertion failure in obsolete csnNormalize23
• CVE-2020-36221: slapd integer underflow crash in Certificate Exact Assertion processing
• CVE-2020-36222: slapd assertion failure in saslAuthzTo validation
• CVE-2020-36223: slapd double free crash in Values Return Filter control handling
• CVE-2020-36224: slapd invalid pointer free and crash in saslAuthzTo processing
• CVE-2020-36225: slapd double free crash in saslAuthzTo processing
• CVE-2020-36226: slapd memch->bv_len miscalculation and crash in saslAuthzTo processing
• CVE-2020-36227: slapd infinite loop via cancel_extop Cancel operation
• CVE-2020-36228: slapd integer underflow crash in Certificate List Exact Assertion processing
• CVE-2020-36229: slapd crash in X.509 DN parsing ad_keystring via ldap_X509dn2bv
• CVE-2020-36230: slapd assertion failure in X.509 DN parsing ber_next_element in decode.c

• CVE-2019-13565: SASL session encryption SSF not reset on new connection, allowing downgrade
• CVE-2020-12243: slapd crash via deeply nested LDAP search filter boolean expressions
• CVE-2020-25692: NULL pointer dereference in slapd during modRDN request
• CVE-2020-25709: slapd assertion failure via crafted certificate list validation
• CVE-2020-25710: slapd assertion failure in obsolete csnNormalize23
• CVE-2020-36221: slapd integer underflow crash in Certificate Exact Assertion processing
• CVE-2020-36222: slapd assertion failure in saslAuthzTo validation
• CVE-2020-36223: slapd double free crash in Values Return Filter control handling
• CVE-2020-36224: slapd invalid pointer free and crash in saslAuthzTo processing
• CVE-2020-36225: slapd double free crash in saslAuthzTo processing
• CVE-2020-36226: slapd memch->bv_len miscalculation and crash in saslAuthzTo processing
• CVE-2020-36227: slapd infinite loop via cancel_extop Cancel operation
• CVE-2020-36228: slapd integer underflow crash in Certificate List Exact Assertion processing
• CVE-2020-36229: slapd crash in X.509 DN parsing ad_keystring via ldap_X509dn2bv
• CVE-2020-36230: slapd assertion failure in X.509 DN parsing ber_next_element in decode.c

Updated openldap packages fix security vulnerabilities:

When both the nops module and the member of overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation (CVE-2017-17740).

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash) (CVE-2020-12243).

The nops overlay has been dropped from the package, fixing CVE-2017-17740.

The openldap package has been updated to version 2.4.50, fixing CVE-2020-12243 and several other bugs.

This update for openldap2 fixes the following issues:

• CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).

This update was imported from the SUSE:SLE-15:Update update project.

This update for openldap2 fixes the following issues:

• CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).

This update for openldap2 fixes the following issues:

• CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).
• CVE-2019-13565: Fixed an authentication bypass caused by incorrect authorization of another connection, granting excess connection rights (bsc#1143194).
• CVE-2019-13057: Fixed an issue with improper authorization with delegated database admin privileges (bsc#1143273).

This update for openldap2 fixes the following issues:

• CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).

This update for openldap2 fixes the following issues:

• CVE-2020-12243: Fixed a denial of service related to recursive filters (bsc#1170771).

It was discovered that OpenLDAP incorrectly handled certain queries. A remote attacker could possibly use this issue to cause OpenLDAP to consume resources, resulting in a denial of service.

USN-4352-1 fixed a vulnerability in OpenLDAP. This update provides the corresponding update for Ubuntu 12.04 ESM and Ubuntu 14.04 ESM.

Original advisory details:

It was discovered that OpenLDAP incorrectly handled certain queries. A remote attacker could possibly use this issue to cause OpenLDAP to consume resources, resulting in a denial of service.