Bugzilla – Bug 1182416
VUL-0: CVE-2020-36225: openldap2: Double free in the saslAuthzTo processing
Last modified: 2021-08-16 11:29:27 UTC
rh#1921385 A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. https://bugs.openldap.org/show_bug.cgi?id=9412 https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439 https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 References: https://bugzilla.redhat.com/show_bug.cgi?id=1921385 http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-36225 https://www.debian.org/security/2021/dsa-4845 https://access.redhat.com/security/cve/CVE-2020-36225 http://www.debian.org/security/-1/dsa-4845 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36225 https://bugs.openldap.org/show_bug.cgi?id=9412 https://git.openldap.org/openldap/openldap/-/commit/554dff1927176579d652f2fe60c90e9abbad4c65 https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 https://git.openldap.org/openldap/openldap/-/commit/5a2017d4e61a6ddc4dcb4415028e0d08eb6bca26 https://git.openldap.org/openldap/openldap/-/commit/d169e7958a3e0dc70f59c8374bf8a59833b7bdd8 https://git.openldap.org/openldap/openldap/-/commit/c0b61a9486508e5202aa2e0cfb68c9813731b439
SUSE-SU-2021:0693-1: An update that fixes 11 vulnerabilities is now available. Category: security (important) Bug References: 1182279,1182408,1182411,1182412,1182413,1182415,1182416,1182417,1182418,1182419,1182420 CVE References: CVE-2020-36221,CVE-2020-36222,CVE-2020-36223,CVE-2020-36224,CVE-2020-36225,CVE-2020-36226,CVE-2020-36227,CVE-2020-36228,CVE-2020-36229,CVE-2020-36230,CVE-2021-27212 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): openldap2-2.4.41-18.83.1 SUSE OpenStack Cloud Crowbar 8 (src): openldap2-2.4.41-18.83.1 SUSE OpenStack Cloud 9 (src): openldap2-2.4.41-18.83.1 SUSE OpenStack Cloud 8 (src): openldap2-2.4.41-18.83.1 SUSE OpenStack Cloud 7 (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Software Development Kit 12-SP5 (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server 12-SP5 (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server 12-SP4-LTSS (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server 12-SP3-LTSS (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server 12-SP3-BCL (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server 12-SP2-LTSS (src): openldap2-2.4.41-18.83.1 SUSE Linux Enterprise Server 12-SP2-BCL (src): openldap2-2.4.41-18.83.1 HPE Helion Openstack 8 (src): openldap2-2.4.41-18.83.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:0692-1: An update that fixes 11 vulnerabilities is now available. Category: security (important) Bug References: 1182279,1182408,1182411,1182412,1182413,1182415,1182416,1182417,1182418,1182419,1182420 CVE References: CVE-2020-36221,CVE-2020-36222,CVE-2020-36223,CVE-2020-36224,CVE-2020-36225,CVE-2020-36226,CVE-2020-36227,CVE-2020-36228,CVE-2020-36229,CVE-2020-36230,CVE-2021-27212 JIRA References: Sources used: SUSE Linux Enterprise Server for SAP 12-SP5 (src): openldap2-2.4.41-39.1 SUSE Linux Enterprise Server for SAP 12-SP4 (src): openldap2-2.4.41-39.1 SUSE Linux Enterprise Server for SAP 12-SP3 (src): openldap2-2.4.41-39.1 SUSE Linux Enterprise Server for SAP 12-SP2 (src): openldap2-2.4.41-39.1 SUSE Linux Enterprise Module for Legacy Software 12 (src): openldap2-2.4.41-39.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2021:0723-1: An update that fixes 11 vulnerabilities is now available. Category: security (important) Bug References: 1182279,1182408,1182411,1182412,1182413,1182415,1182416,1182417,1182418,1182419,1182420 CVE References: CVE-2020-36221,CVE-2020-36222,CVE-2020-36223,CVE-2020-36224,CVE-2020-36225,CVE-2020-36226,CVE-2020-36227,CVE-2020-36228,CVE-2020-36229,CVE-2020-36230,CVE-2021-27212 JIRA References: Sources used: SUSE Manager Server 4.0 (src): openldap2-2.4.46-9.48.1 SUSE Manager Retail Branch Server 4.0 (src): openldap2-2.4.46-9.48.1 SUSE Manager Proxy 4.0 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Server for SAP 15-SP1 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Server for SAP 15 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Server 15-SP1-LTSS (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Server 15-SP1-BCL (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Server 15-LTSS (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Module for Legacy Software 15-SP3 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Module for Legacy Software 15-SP2 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Module for Development Tools 15-SP3 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Module for Development Tools 15-SP2 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Module for Basesystem 15-SP3 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise Module for Basesystem 15-SP2 (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise High Performance Computing 15-SP1-LTSS (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise High Performance Computing 15-SP1-ESPOS (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise High Performance Computing 15-LTSS (src): openldap2-2.4.46-9.48.1 SUSE Linux Enterprise High Performance Computing 15-ESPOS (src): openldap2-2.4.46-9.48.1 SUSE Enterprise Storage 6 (src): openldap2-2.4.46-9.48.1 SUSE CaaS Platform 4.0 (src): openldap2-2.4.46-9.48.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
openSUSE-SU-2021:0408-1: An update that fixes 11 vulnerabilities is now available. Category: security (important) Bug References: 1182279,1182408,1182411,1182412,1182413,1182415,1182416,1182417,1182418,1182419,1182420 CVE References: CVE-2020-36221,CVE-2020-36222,CVE-2020-36223,CVE-2020-36224,CVE-2020-36225,CVE-2020-36226,CVE-2020-36227,CVE-2020-36228,CVE-2020-36229,CVE-2020-36230,CVE-2021-27212 JIRA References: Sources used: openSUSE Leap 15.2 (src): openldap2-2.4.46-lp152.14.18.1
SUSE-SU-2021:14700-1: An update that solves 11 vulnerabilities and has one errata is now available. Category: security (important) Bug References: 1182279,1182408,1182411,1182412,1182413,1182415,1182416,1182417,1182418,1182419,1182420,1184020 CVE References: CVE-2020-36221,CVE-2020-36222,CVE-2020-36223,CVE-2020-36224,CVE-2020-36225,CVE-2020-36226,CVE-2020-36227,CVE-2020-36228,CVE-2020-36229,CVE-2020-36230,CVE-2021-27212 JIRA References: Sources used: SUSE Linux Enterprise Server 11-SP4-LTSS (src): openldap2-2.4.26-0.74.26.1, openldap2-client-2.4.26-0.74.26.1 SUSE Linux Enterprise Server 11-SECURITY (src): openldap2-client-openssl1-2.4.26-0.74.26.1 SUSE Linux Enterprise Point of Sale 11-SP3 (src): openldap2-2.4.26-0.74.26.1, openldap2-client-2.4.26-0.74.26.1 SUSE Linux Enterprise Debuginfo 11-SP4 (src): openldap2-2.4.26-0.74.26.1, openldap2-client-2.4.26-0.74.26.1 SUSE Linux Enterprise Debuginfo 11-SP3 (src): openldap2-2.4.26-0.74.26.1, openldap2-client-2.4.26-0.74.26.1, openldap2-client-openssl1-2.4.26-0.74.26.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
done