MGASA-2021-0105

Dashboard / Vulnerabilities / MGASA-2021-0105

MGASA-2021-0105

Summary: Updated openldap packages fix security vulnerabilities

Details: It was discovered that OpenLDAP incorrectly handled Certificate Exact Assertion processing. A remote attacker could possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service (CVE-2020-36221). It was discovered that OpenLDAP incorrectly handled saslAuthzTo processing. A remote attacker could use this issue to cause OpenLDAP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2020-36222, CVE-2020-36224, CVE-2020-36225, CVE-2020-36226). It was discovered that OpenLDAP incorrectly handled Return Filter control handling. A remote attacker could use this issue to cause OpenLDAP to crash, resulting in a denial of service, or possibly execute arbitrary code (CVE-2020-36223). It was discovered that OpenLDAP incorrectly handled certain cancel operations. A remote attacker could possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service (CVE-2020-36227). It was discovered that OpenLDAP incorrectly handled Certificate List Extract Assertion processing. A remote attacker could possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service (CVE-2020-36228). It was discovered that OpenLDAP incorrectly handled X.509 DN parsing. A remote attacker could possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service (CVE-2020-36229, CVE-2020-36230). Pasi Saarinen discovered that OpenLDAP incorrectly handled certain short timestamps. A remote attacker could possibly use this issue to cause OpenLDAP to crash, resulting in a denial of service (CVE-2021-27212).

References: https://advisories.mageia.org/MGASA-2021-0105.html, https://bugs.mageia.org/show_bug.cgi?id=28300, https://ubuntu.com/security/notices/USN-4724-1, https://ubuntu.com/security/notices/USN-4744-1