chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server.
CVSS Details
- CVSS 3.1 Base Score: 8.1
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade compat-openldapUpgrade openldap-serversUpgrade openldap-servers-overlaysUpgrade openldap-clientsUpgrade openldap-develUpgrade openldapUpgrade openldap-servers-sql | Dec 1, 2016 | Mar 19, 2011 |
| Debian | — | Upgrade openldap | Jul 30, 2024 | Mar 20, 2011 |
| Gentoo Linux | — | Upgrade net-nds/openldap. | Oct 30, 2017 | Mar 19, 2011 |
| Oracle_linux | — | Upgrade compat-openldapUpgrade openldapUpgrade openldap-serversUpgrade openldap-develUpgrade openldap-clientsUpgrade openldap-servers-sql | Oct 16, 2024 | Mar 20, 2011 |
| Suse | — | Upgrade openldap2Upgrade openldap2-back-sqlUpgrade openldap2-back-metaUpgrade openldap2-docUpgrade openldap2-back-perl | Feb 17, 2015 | Mar 19, 2011 |
| Ubuntu | — | Upgrade slapd | Nov 8, 2024 | Mar 20, 2011 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub