A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service.
Fix
Patch, vendor advisory and mitigation references on NVD 10
- https://bugs.openldap.org/show_bug.cgi?id=9406 Issue Tracking, Vendor Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9407 Issue Tracking, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0 Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 Release Notes, Vendor Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9406 Issue Tracking, Vendor Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9407 Issue Tracking, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0 Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 Release Notes, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 7.5 · openldap, debian, appleNVD modified 2026-10-14 10:17
Affected (CPE criteria) 22
cpe:2.3:a:openldap:openldap:*:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:*:*:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:-:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-004:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-005:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-006:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2019-007:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-001:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-002:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-003:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-004:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-005:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-006:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2020-007:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-001:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-002:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:security_update_2021-003:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update:*:*:*:*:*:*cpe:2.3:o:apple:mac_os_x:10.14.6:supplemental_update_2:*:*:*:*:*:*cpe:2.3:o:apple:macos:*:*:*:*:*:*:*:*
References 35
- http://seclists.org/fulldisclosure/2021/May/64 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/May/65 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/May/70 Mailing List, Third Party Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9406 Issue Tracking, Vendor Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9407 Issue Tracking, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0 Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed.aa Broken Link
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 Release Notes, Vendor Advisory
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210226-0002/ Third Party Advisory
- https://support.apple.com/kb/HT212529 Third Party Advisory
- https://support.apple.com/kb/HT212530 Third Party Advisory
- https://support.apple.com/kb/HT212531 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4845 Third Party Advisory
- http://seclists.org/fulldisclosure/2021/May/64 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/May/65 Mailing List, Third Party Advisory
- http://seclists.org/fulldisclosure/2021/May/70 Mailing List, Third Party Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9406 Issue Tracking, Vendor Advisory
- https://bugs.openldap.org/show_bug.cgi?id=9407 Issue Tracking, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/02dfc32d658fadc25e4040f78e36592f6e1e1ca0 Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed Patch, Vendor Advisory
- https://git.openldap.org/openldap/openldap/-/commit/6ed057b5b728b50746c869bcc9c1f85d0bbbf6ed.aa Broken Link
- https://git.openldap.org/openldap/openldap/-/tags/OPENLDAP_REL_ENG_2_4_57 Release Notes, Vendor Advisory
- https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/02/msg00005.html Mailing List, Third Party Advisory
- https://security.netapp.com/advisory/ntap-20210226-0002/ Third Party Advisory
- https://support.apple.com/kb/HT212529 Third Party Advisory
- https://support.apple.com/kb/HT212530 Third Party Advisory
- https://support.apple.com/kb/HT212531 Third Party Advisory
- https://www.debian.org/security/2021/dsa-4845 Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html