CVE Vulnerabilities

CVE-2020-12243

Uncontrolled Recursion

Published: Apr 28, 2020 | Modified: Apr 29, 2022
CVSS 3.x
7.5
HIGH
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:N/A:P
RedHat/V2
RedHat/V3
7.5 MODERATE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Ubuntu

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Weakness

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

Affected Software

Name Vendor Start Version End Version
Openldap Openldap * *
Red Hat Enterprise Linux 7 RedHat openldap-0:2.4.44-22.el7 *
Openldap Ubuntu bionic *
Openldap Ubuntu devel *
Openldap Ubuntu eoan *
Openldap Ubuntu esm-infra/xenial *
Openldap Ubuntu focal *
Openldap Ubuntu precise/esm *
Openldap Ubuntu trusty *
Openldap Ubuntu trusty/esm *
Openldap Ubuntu upstream *
Openldap Ubuntu xenial *

Potential Mitigations

References