Skip to content
OpenAdvisories
Medium ALAS2-2022-1770 2 CVEs

Moderate: openldap security update (Amazon Linux 2)

Published Apr 4, 2022 · Updated Apr 6, 2022

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-25710: A flaw was found in OpenLDAP. This flaw allows an attacker who sends a malicious packet processed by OpenLDAP to force a failed assertion in csnNormalize23(). The highest threat from this vulnerability is to system availability. CVE-2020-25709: A flaw was found in OpenLDAP. This flaw allows an attacker who can send a malicious packet to be processed by OpenLDAP's slapd server, to trigger an assertion failure. The highest threat from this vulnerability is to system availability.

Fixed packages 6

ReleasePackageFixed in
Amazon Linux · 2 openldap 0:2.4.44-23.amzn2.0.3
Amazon Linux · 2 openldap-clients 0:2.4.44-23.amzn2.0.3
Amazon Linux · 2 openldap-debuginfo 0:2.4.44-23.amzn2.0.3
Amazon Linux · 2 openldap-devel 0:2.4.44-23.amzn2.0.3
Amazon Linux · 2 openldap-servers 0:2.4.44-23.amzn2.0.3
Amazon Linux · 2 openldap-servers-sql 0:2.4.44-23.amzn2.0.3

Vulnerabilities 2

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-25709.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-25710.html