Advisories ยป MGASA-2021-0105

Updated openldap packages fix security vulnerabilities

Publication date: 04 Mar 2021
Modification date: 04 Mar 2021
Type: security
Affected Mageia releases : 7 , 8
CVE: CVE-2020-36221 , CVE-2020-36222 , CVE-2020-36223 , CVE-2020-36224 , CVE-2020-36225 , CVE-2020-36226 , CVE-2020-36227 , CVE-2020-36228 , CVE-2020-36229 , CVE-2020-36230 , CVE-2021-27212

Description

It was discovered that OpenLDAP incorrectly handled Certificate Exact
Assertion processing. A remote attacker could possibly use this issue to cause
OpenLDAP to crash, resulting in a denial of service (CVE-2020-36221).

It was discovered that OpenLDAP incorrectly handled saslAuthzTo processing. A
remote attacker could use this issue to cause OpenLDAP to crash, resulting in
a denial of service, or possibly execute arbitrary code (CVE-2020-36222,
CVE-2020-36224, CVE-2020-36225, CVE-2020-36226).

It was discovered that OpenLDAP incorrectly handled Return Filter control
handling. A remote attacker could use this issue to cause OpenLDAP to crash,
resulting in a denial of service, or possibly execute arbitrary code
(CVE-2020-36223).

It was discovered that OpenLDAP incorrectly handled certain cancel operations.
A remote attacker could possibly use this issue to cause OpenLDAP to crash,
resulting in a denial of service (CVE-2020-36227).

It was discovered that OpenLDAP incorrectly handled Certificate List Extract
Assertion processing. A remote attacker could possibly use this issue to cause
OpenLDAP to crash, resulting in a denial of service (CVE-2020-36228).

It was discovered that OpenLDAP incorrectly handled X.509 DN parsing. A remote
attacker could possibly use this issue to cause OpenLDAP to crash, resulting
in a denial of service (CVE-2020-36229, CVE-2020-36230).

Pasi Saarinen discovered that OpenLDAP incorrectly handled certain short
timestamps. A remote attacker could possibly use this issue to cause OpenLDAP
to crash, resulting in a denial of service (CVE-2021-27212).

References

SRPMS

8/core

7/core