chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade openldap-develUpgrade openldap-clientsUpgrade openldap-servers-sqlUpgrade openldapUpgrade openldap-servers-overlaysUpgrade openldap-serversUpgrade compat-openldap | Dec 1, 2016 | Mar 19, 2011 |
| Debian | — | Upgrade openldap | Jul 30, 2024 | Mar 20, 2011 |
| Gentoo Linux | — | Upgrade net-nds/openldap. | Oct 30, 2017 | Mar 19, 2011 |
| Oracle_linux | — | Upgrade openldap-servers-sqlUpgrade openldap-clientsUpgrade openldap-serversUpgrade compat-openldapUpgrade openldapUpgrade openldap-devel | Oct 16, 2024 | Mar 20, 2011 |
| Suse | — | Upgrade openldap2-back-metaUpgrade openldap2-back-perlUpgrade openldap2-docUpgrade openldap2-back-sqlUpgrade openldap2 | Feb 17, 2015 | Mar 19, 2011 |
| Ubuntu | — | Upgrade slapd | Nov 8, 2024 | Mar 20, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub