Denial Of Service (DoS)

2019-01-1508:56:00

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

0.94 High

EPSS

Percentile

99.2%

JSON

openldap is vulnerable to denial of service (DoS) attacks. The vulnerability exists as the rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.

CPENameOperatorVersion
openldapeq2.3.43__3.el5
openldapeq2.3.43__12.el5_6.5
openldapeq2.4.19__15.el6_0.2
openldapeq2.4.23__31.el6
openldapeq2.3.43__12.el5_5.2
openldapeq2.4.23__15.el6_1.3
openldapeq2.3.43__12.el5_5.1
openldapeq2.3.43__12.el5
openldapeq2.3.43__12.el5_7.9
openldapeq2.4.19__15.el6

Name	Operator	Version
openldap	eq	2.3.43__3.el5
openldap	eq	2.3.43__12.el5_6.5
openldap	eq	2.4.19__15.el6_0.2
openldap	eq	2.4.23__31.el6
openldap	eq	2.3.43__12.el5_5.2
openldap	eq	2.4.23__15.el6_1.3
openldap	eq	2.3.43__12.el5_5.1
openldap	eq	2.3.43__12.el5
openldap	eq	2.3.43__12.el5_7.9
openldap	eq	2.4.19__15.el6