Description
OpenLDAP 2.4.22 allows remote attackers to cause a denial of service (crash) via a modrdn call with a zero-length RDN destination string, which is not properly handled by the smr_normalize function and triggers a NULL pointer dereference in the IA5StringNormalize function in schema_init.c, as demonstrated using the Codenomicon LDAPv3 test suite.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openldap | 2.4.23-1 | — |
| Debian 13 | openldap | 2.4.23-1 | — |
| Debian 12 | openldap | 2.4.23-1 | — |
| Debian 5.0 | openldap | 2.4.11-1+lenny2 | DSA-2077-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | compat-openldap | 2.3.43_2.2.29-12.el5_5.1 | RHSA-2010:0542 |
| RHEL 5 | openldap +5 | 2.3.43-12.el5_5.1 | RHSA-2010:0542 |
Advisories 2
- RHSA-2010:0542 Red Hat Security Advisory: openldap security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2077-1 openldap - potential code execution Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1024221 vdb-entry
- http://support.apple.com/kb/HT4435
- GLSA-201406-36 vendor-advisory
- http://www.openldap.org/its/index.cgi/Software%20Bugs?id=6570
- http://www.vmware.com/security/advisories/VMSA-2011-0001.html
- ADV-2010-1858 vdb-entry
- APPLE-SA-2010-11-10-1 vendor-advisory
- ADV-2010-1849 vdb-entry
- 41770 vdb-entry
- RHSA-2010:0542 vendor-advisory
- 40687 third-party-advisory
- 20110105 VMSA-2011-0001 VMware ESX third party updates for Service Console packages glibc, sudo, and openldap mailing-list
- SUSE-SR:2010:014 vendor-advisory
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
- 40639 third-party-advisory
- 42787 third-party-advisory
- ADV-2011-0025 vdb-entry
- http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10735