The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
CVSS Details
- CVSS 3.1 Base Score: 7.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Openldap | — | Apply Apple macOS Security Update 2019-007 High SierraApply Apple macOS Security Update 2019-002 Mojave | Dec 11, 2019 | Dec 10, 2019 |
| Centos_linux | — | Upgrade openldap-servers-sqlUpgrade compat-openldapUpgrade openldap-clientsUpgrade openldap-serversUpgrade openldap-servers-overlaysUpgrade openldap-develUpgrade openldap | Dec 1, 2016 | Feb 5, 2014 |
| Debian | — | Upgrade openldap | Jul 30, 2024 | Feb 5, 2014 |
| Oracle_linux | — | Upgrade openldap-serversUpgrade openldap-servers-sqlUpgrade openldap-clientsUpgrade openldapUpgrade openldap-devel | Oct 16, 2024 | Feb 5, 2014 |
| Suse | — | Upgrade libldap-2_4-2Upgrade libldap-openssl1-2_4-2-x86Upgrade libldap-openssl1-2_4-2-32bitUpgrade openldap2-clientUpgrade libldap-openssl1-2_4-2Upgrade compat-libldap-2_3-0Upgrade openldap2-develUpgrade openldap2Upgrade libldap-2_4-2-x86Upgrade libldap-2_4-2-32bitUpgrade openldap2-back-perlUpgrade sle-sdk-releaseUpgrade openldap2-devel-32bitUpgrade openldap2-back-meta | Jun 4, 2015 | Feb 5, 2014 |
| Ubuntu | — | Upgrade slapd | Nov 8, 2024 | Feb 5, 2014 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub