CVE-2020-25692

Name	CVE-2020-25692
Description	A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2425-1, DSA-4782-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
openldap (PTS)	bullseye (security), bullseye	2.4.57+dfsg-3+deb11u1	fixed
	bookworm	2.5.13+dfsg-5	fixed
	sid, trixie	2.5.18+dfsg-3	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
openldap	source	stretch	2.4.44+dfsg-5+deb9u5	DLA-2425-1
openldap	source	buster	2.4.47+dfsg-3+deb10u3	DSA-4782-1
openldap	source	(unstable)	2.4.55+dfsg-1

https://bugs.openldap.org/show_bug.cgi?id=9370
https://git.openldap.org/openldap/openldap/-/commit/4c774220a752bf8e3284984890dc0931fe73165d