CVE-2020-12243High· 7.5▾ TwilightIn filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.9 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
4.4%
In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).
openldap < 2.4.50debian_linux = 8.0debian_linux = 9.0debian_linux = 10.0leap = 15.1ubuntu_linux = 12.04ubuntu_linux = 14.04ubuntu_linux = 16.04ubuntu_linux = 18.04ubuntu_linux = 19.10ubuntu_linux = 20.04cloud_backupsteelstore_cloud_integrated_storageh410c_firmwareh300s_firmwareh500s_firmwareh700s_firmwareh300e_firmwareh500e_firmwareh700e_firmwareh410s_firmwarebrocade_fabric_operating_systemmac_os_x >= 10.13.0, < 10.13.6mac_os_x >= 10.14.0, < 10.14.6mac_os_x >= 10.15, < 10.15.6mac_os_x = 10.13.6mac_os_x = 10.14.6zfs_storage_appliance_kit = 8.8solaris = 10solaris = 11Upgrade past the affected range:
openldap 2.4.50mac_os_x 10.15.6Connected by shared product, vendor, weakness, or advisory.
CVE-2019-13565High· 7.5An issue was discovered in OpenLDAP 2.x before 2.4.48
CVE-2019-13057Medium· 4.9An issue was discovered in the server in OpenLDAP before 2.4.48
CVE-2020-28196High· 7.5MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.
CVE-2020-8285High· 7.5curl 7.21.0 to and including 7.73.0 is vulnerable to uncontrolled recursion due to a stack overflow issue in FTP wildcard match parsing.
CVE-2021-45105Medium· 5.9Apache Log4j2 versions 2.0-alpha1 through 2.16.0 (excluding 2.12.3 and 2.3.1) did not protect from uncontrolled recursion from self-referential lookups
CVE-2021-27212High· 7.5In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp