| Package | Affected versions | Patched versions |
|---|---|---|
| openldap | = 2.4.10= 2.4.11= 2.4.12= 2.4.13= 2.4.14= 2.4.15= 2.4.16= 2.4.17= 2.4.18= 2.4.19= 2.4.20= 2.4.21= 2.4.22= 2.4.23= 2.4.24= 2.4.25= 2.4.26= 2.4.27= 2.4.28= 2.4.29= 2.4.30= 2.4.31= 2.4.32= 2.4.33= 2.4.34= 2.4.35= 2.4.6= 2.4.7= 2.4.8= 2.4.9≤ 2.4.36 |
The rwm overlay in OpenLDAP 2.4.23, 2.4.36, and earlier does not properly count references, which allows remote attackers to cause a denial of service (slapd crash) by unbinding immediately after a search request, which triggers rwm_conn_destroy to free the session context while it is being used by rwm_op_search.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free