Debian Openldap vulnerabilities

CVE-2019-13565 [HIGH] CVE-2019-13565: openldap - An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentic... An issue was discovered in OpenLDAP 2.x before 2.4.48. When using SASL authentication and session encryption, and relying on the SASL security layers in slapd access controls, it is possible to obtain access that would otherwise be denied via a simple bind for any identity covered in those ACLs. After the first SASL bind is completed, the sasl_ssf value is retained

CVE-2019-13057 [MEDIUM] CVE-2019-13057: openldap - An issue was discovered in the server in OpenLDAP before 2.4.48. When the server... An issue was discovered in the server in OpenLDAP before 2.4.48. When the server administrator delegates rootDN (database admin) privileges for certain databases but wants to maintain isolation (e.g., for multi-tenant deployments), slapd does not properly stop a rootDN from requesting authorization as an identity from another database during a SASL bind or with a

CVE-2017-9287 [MEDIUM] CVE-2017-9287: openldap - servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double ... servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user with access to search the directory can crash slapd by issuing a search including the Paged Results control with a page size of 0. Scope: local bookworm: resolved (fixed in 2.4.44+dfsg-5) bullseye: resolved (fixed in 2.4.44+dfsg-5) forky: resolved (fixed in 2.

CVE-2017-17740 [HIGH] CVE-2017-17740: openldap - contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops... contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2017-14159 [MEDIUM] CVE-2017-14159: openldap - slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privilege... slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by leveraging access to this non-root account for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated by openldap-initscript. Scope: local bookworm: ope

CVE-2016-4984 [MEDIUM] CVE-2016-4984: openldap - /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak perm... /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between the creation of the certificate, and the chmod to protect it. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2015-6908 [MEDIUM] CVE-2015-6908: openldap - The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earli... The ber_get_next function in libraries/liblber/io.c in OpenLDAP 2.4.42 and earlier allows remote attackers to cause a denial of service (reachable assertion and application crash) via crafted BER data, as demonstrated by an attack against slapd. Scope: local bookworm: resolved (fixed in 2.4.42+dfsg-2) bullseye: resolved (fixed in 2.4.42+dfsg-2) forky: resolved (fix

CVE-2015-1546 [MEDIUM] CVE-2015-1546: openldap - Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c... Double free vulnerability in the get_vrFilter function in servers/slapd/filter.c in OpenLDAP 2.4.40 allows remote attackers to cause a denial of service (crash) via a crafted search query with a matched values control. Scope: local bookworm: resolved (fixed in 2.4.40-4) bullseye: resolved (fixed in 2.4.40-4) forky: resolved (fixed in 2.4.40-4) sid: resolved (fixed

CVE-2015-1545 [MEDIUM] CVE-2015-1545: openldap - The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.1... The deref_parseCtrl function in servers/slapd/overlays/deref.c in OpenLDAP 2.4.13 through 2.4.40 allows remote attackers to cause a denial of service (NULL pointer dereference and crash) via an empty attribute list in a deref control in a search request. Scope: local bookworm: resolved (fixed in 2.4.40-4) bullseye: resolved (fixed in 2.4.40-4) forky: resolved (fixe

CVE-2015-3276 [HIGH] CVE-2015-3276: openldap - The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not... The nss_parse_ciphers function in libraries/libldap/tls_m.c in OpenLDAP does not properly parse OpenSSL-style multi-keyword mode cipher strings, which might cause a weaker than intended cipher to be used and allow remote attackers to have unspecified impact via unknown vectors. Scope: local bookworm: open bullseye: open forky: open sid: open trixie: open

CVE-2014-9713 [MEDIUM] CVE-2014-9713: openldap - The default slapd configuration in the Debian openldap package 2.4.23-3 through ... The default slapd configuration in the Debian openldap package 2.4.23-3 through 2.4.39-1.1 allows remote authenticated users to modify the user's permissions and other user attributes via unspecified vectors. Scope: local bookworm: resolved (fixed in 2.4.40-2) bullseye: resolved (fixed in 2.4.40-2) forky: resolved (fixed in 2.4.40-2) sid: resolved (fixed in 2.4.40-

CVE-2014-8182 [HIGH] CVE-2014-8182: openldap - An off-by-one error leading to a crash was discovered in openldap 2.4 when proce... An off-by-one error leading to a crash was discovered in openldap 2.4 when processing DNS SRV messages. If slapd was configured to use the dnssrv backend, an attacker could crash the service with crafted DNS responses. Scope: local bookworm: resolved bullseye: resolved forky: resolved sid: resolved trixie: resolved

CVE-2013-4449 [MEDIUM] CVE-2013-4449: openldap - The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count ... The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search. Scope: local bookworm: resolved (fixed in 2.4.39-1.1

CVE-2012-1164 [LOW] CVE-2012-1164: openldap - slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of ser... slapd in OpenLDAP before 2.4.30 allows remote attackers to cause a denial of service (assertion failure and daemon exit) via an LDAP search query with attrsOnly set to true, which causes empty attributes to be returned. Scope: local bookworm: resolved (fixed in 2.4.31-1) bullseye: resolved (fixed in 2.4.31-1) forky: resolved (fixed in 2.4.31-1) sid: resolved (fixed in

CVE-2012-2668 [MEDIUM] CVE-2012-2668: openldap - libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using t... libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information. Scope: local bookworm: resolved bullseye: resolved forky:

CVE-2011-4079 [MEDIUM] CVE-2011-4079: openldap - Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earl... Off-by-one error in the UTF8StringNormalize function in OpenLDAP 2.4.26 and earlier allows remote attackers to cause a denial of service (slapd crash) via a zero-length string that triggers a heap-based buffer overflow, as demonstrated using an empty postalAddressAttribute value in an LDIF entry. Scope: local bookworm: resolved (fixed in 2.4.28-1) bullseye: resolve

CVE-2011-1081 [MEDIUM] CVE-2011-1081: openldap - modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cau... modrdn.c in slapd in OpenLDAP 2.4.x before 2.4.24 allows remote attackers to cause a denial of service (daemon crash) via a relative Distinguished Name (DN) modification request (aka MODRDN operation) that contains an empty value for the OldDN field. Scope: local bookworm: resolved (fixed in 2.4.25-1) bullseye: resolved (fixed in 2.4.25-1) forky: resolved (fixed in

CVE-2011-1024 [MEDIUM] CVE-2011-1024: openldap - chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave config... chain.c in back-ldap in OpenLDAP 2.4.x before 2.4.24, when a master-slave configuration with a chain overlay and ppolicy_forward_updates (aka authentication-failure forwarding) is used, allows remote authenticated users to bypass external-program authentication by sending an invalid password to a slave server. Scope: local bookworm: resolved (fixed in 2.4.25-1) bul

CVE-2011-1025 [MEDIUM] CVE-2011-1025: openldap - bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentica... bind.cpp in back-ndb in OpenLDAP 2.4.x before 2.4.24 does not require authentication for the root Distinguished Name (DN), which allows remote attackers to bypass intended access restrictions via an arbitrary password. Scope: local bookworm: resolved (fixed in 2.4.25-1) bullseye: resolved (fixed in 2.4.25-1) forky: resolved (fixed in 2.4.25-1) sid: resolved (fixed

CVE-2010-0211 [CRITICAL] CVE-2010-0211: openldap - The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the ... The slap_modrdn2mods function in modrdn.c in OpenLDAP 2.4.22 does not check the return value of a call to the smr_normalize function, which allows remote attackers to cause a denial of service (segmentation fault) and possibly execute arbitrary code via a modrdn call with an RDN string containing invalid UTF-8 sequences, which triggers a free of an invalid, unini