CVE-2020-12243

Description

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

CVSS breakdown

Affected products

• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.14.6 – 10.14.6
• Apple / mac_os_x10.13.0 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Apple / mac_os_x10.13.6 – 10.13.6
• Broadcom / brocade_fabric_operating_system
• Canonical / Ubuntu Linux19.10 – 19.10
• Canonical / Ubuntu Linux20.04 – 20.04
• Canonical / Ubuntu Linux18.04 – 18.04
• Canonical / Ubuntu Linux12.04 – 12.04
• Canonical / Ubuntu Linux14.04 – 14.04
• Canonical / Ubuntu Linux16.04 – 16.04
• Debian / debian_linux8.0 – 8.0
• Debian / debian_linux9.0 – 9.0
• Debian / debian_linux10.0 – 10.0
• NetApp / cloud_backup
• NetApp / h300e_firmware
• NetApp / h300s_firmware
• NetApp / h410c_firmware
• NetApp / h410s_firmware
• NetApp / h500e_firmware
• NetApp / h500s_firmware
• NetApp / h700e_firmware
• NetApp / h700s_firmware
• NetApp / steelstore_cloud_integrated_storage
• openldap / openldap2.4.50
• openSUSE / Leap15.1 – 15.1
• oracle / solaris10 – 10
• oracle / solaris11 – 11
• oracle / zfs_storage_appliance_kit8.8 – 8.8

References

• VENDOR_ADVISORYhttps://www.debian.org/security/2020/dsa-4666
• MAILING_LISThttps://lists.debian.org/debian-lts-announce/2020/05/msg00001.html
• VENDOR_ADVISORYhttps://usn.ubuntu.com/4352-2/
• MAILING_LISThttp://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html
• VENDOR_ADVISORYhttps://usn.ubuntu.com/4352-1/
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuoct2020.html
• MISChttps://bugs.openldap.org/show_bug.cgi?id=9202
• MISChttps://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES
• MISChttps://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440
• MISChttps://security.netapp.com/advisory/ntap-20200511-0003/
• VENDOR_ADVISORYhttps://support.apple.com/kb/HT211289
• VENDOR_ADVISORYhttps://www.oracle.com/security-alerts/cpuapr2022.html