CVE-2020-12243

7.5 high Modified

In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash).

Fix

Patch, vendor advisory and mitigation references on NVD 8

https://bugs.openldap.org/show_bug.cgi?id=9202 Exploit, Patch, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES Release Notes, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch, Third Party Advisory
https://bugs.openldap.org/show_bug.cgi?id=9202 Exploit, Patch, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES Release Notes, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 Patch, Vendor Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch, Third Party Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 1

2026-10-15 00:45First seenCVSS 7.5 · openldap, debian, opensuseNVD modified 2026-10-14 10:17

Affected (CPE criteria) 57

cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:leap:15.1:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:20.04:*:*:*:lts:*:*:*
cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:steelstore_cloud_integrated_storage:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410c_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h300e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h500e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h700e_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:netapp:h410s_firmware:-:*:*:*:*:*:*:*
cpe:2.3:o:broadcom:brocade_fabric_operating_system:-:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2018-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-004:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-005:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-006:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2019-007:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:security_update_2020-003:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.13.6:supplemental_update:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-001:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-002:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*
cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*
and 17 more

References 25

http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html Mailing List, Third Party Advisory
https://bugs.openldap.org/show_bug.cgi?id=9202 Exploit, Patch, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES Release Notes, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200511-0003/ Third Party Advisory
https://support.apple.com/kb/HT211289 Third Party Advisory
https://usn.ubuntu.com/4352-1/ Third Party Advisory
https://usn.ubuntu.com/4352-2/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4666 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2020-05/msg00016.html Mailing List, Third Party Advisory
https://bugs.openldap.org/show_bug.cgi?id=9202 Exploit, Patch, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/blob/OPENLDAP_REL_ENG_2_4/CHANGES Release Notes, Vendor Advisory
https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440 Patch, Vendor Advisory
https://lists.debian.org/debian-lts-announce/2020/05/msg00001.html Mailing List, Third Party Advisory
https://security.netapp.com/advisory/ntap-20200511-0003/ Third Party Advisory
https://support.apple.com/kb/HT211289 Third Party Advisory
https://usn.ubuntu.com/4352-1/ Third Party Advisory
https://usn.ubuntu.com/4352-2/ Third Party Advisory
https://www.debian.org/security/2020/dsa-4666 Third Party Advisory
https://www.oracle.com/security-alerts/cpuapr2022.html Third Party Advisory
https://www.oracle.com/security-alerts/cpuoct2020.html Patch, Third Party Advisory
https://cert-portal.siemens.com/productcert/html/ssa-398330.html