Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25692: A NULL pointer dereference flaw was found in the OpenLDAP server, during a request for renaming RDNs. This flaw allows a remote, unauthenticated attacker to crash the slapd process by sending a specially crafted request, causing a denial of service. The highest threat from this vulnerability is to system availability. 1894567: CVE-2020-25692 openldap: NULL pointer dereference for unauthenticated packet in slapd
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | openldap | 0:2.4.44-23.amzn2 |
| Amazon Linux · 2 | openldap-clients | 0:2.4.44-23.amzn2 |
| Amazon Linux · 2 | openldap-debuginfo | 0:2.4.44-23.amzn2 |
| Amazon Linux · 2 | openldap-devel | 0:2.4.44-23.amzn2 |
| Amazon Linux · 2 | openldap-servers | 0:2.4.44-23.amzn2 |
| Amazon Linux · 2 | openldap-servers-sql | 0:2.4.44-23.amzn2 |
Vulnerabilities 1
-
Unscored —
A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2020-25692.html