chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade compat-openldapUpgrade openldap-serversUpgrade openldap-servers-overlaysUpgrade openldap-develUpgrade openldap-servers-sqlUpgrade openldap-clientsUpgrade openldap | Dec 1, 2016 | Mar 19, 2011 |
| Debian | — | Upgrade openldap | Jul 30, 2024 | Mar 20, 2011 |
| Gentoo Linux | — | Upgrade net-nds/openldap. | Oct 30, 2017 | Mar 19, 2011 |
| Oracle_linux | — | Upgrade compat-openldapUpgrade openldap-serversUpgrade openldap-develUpgrade openldapUpgrade openldap-clientsUpgrade openldap-servers-sql | Oct 16, 2024 | Mar 20, 2011 |
| Suse | — | Upgrade openldap2Upgrade openldap2-docUpgrade openldap2-back-perlUpgrade openldap2-back-sqlUpgrade openldap2-back-meta | Feb 17, 2015 | Mar 19, 2011 |
| Ubuntu | — | Upgrade slapd | Nov 8, 2024 | Mar 20, 2011 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub