Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-46823: python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | python-ldap | 0:2.4.15-2.amzn2.0.3 |
| Amazon Linux · 2 | python-ldap-debuginfo | 0:2.4.15-2.amzn2.0.3 |
Vulnerabilities 1
-
Medium 6.5
Denial of Service in python-ldap
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authent…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-46823.html