Description
libldap in certain third-party OpenLDAP packages has a certificate-validation flaw when the third-party package is asserting RFC6125 support. It considers CN even when there is a non-matching subjectAltName (SAN). This is fixed in, for example, openldap-2.4.46-10.el8 in Red Hat Enterprise Linux.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | openldap | No fix yet | — |
| Debian 13 | openldap | No fix yet | — |
| Debian 12 | openldap | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | openldap +2 | 2.4.46-10.el8 | RHBA-2019:3674 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP2 | openldap2 | 2.4.46-9.34.1 | SUSE-SU-2020:2581-1 |
| SLES 15 SP1 | openldap2 | 2.4.46-9.34.1 | SUSE-SU-2020:2581-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.2 | openldap2 | 2.4.46-lp152.14.6.1 | openSUSE-SU-2020:1459-1 |
| openSUSE Leap 15.1 | openldap2 | 2.4.46-lp151.10.15.1 | openSUSE-SU-2020:1416-1 |
Advisories 6
- WID-SEC-2026-4026 Red Hat OpenShift: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- SUSE-SU-2020:2581-1 Security update for openldap2 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2020:1416-1 Security update for openldap2 SUSE / openSUSE Security Updates · Feb 4, 2026
- RHBA-2019:3674 Red Hat Bug Fix Advisory: openldap bug fix and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2020:1459-1 Security update for openldap2 SUSE / openSUSE Security Updates · May 7, 2025
- WID-SEC-2024-3162 OpenLDAP: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Oct 14, 2024
References
- https://bugzilla.redhat.com/show_bug.cgi?id=1740070
- https://bugs.openldap.org/show_bug.cgi?id=9266
- https://access.redhat.com/errata/RHBA-2019:3674
- openSUSE-SU-2020:1416 vendor-advisory
- openSUSE-SU-2020:1459 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://kc.mcafee.com/corporate/index?page=content&id=SB10365