CVE-2021-46823

CVE	CVE-2021-46823
State	PUBLIC
Assigner	[email protected]
Source Priority	CVE Program / NVD first with legacy fallback
Published	2022-06-18 16:15:00 UTC
Updated	2023-08-08 14:22:00 UTC
Description	python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.

Problem Types: CWE-1333

Type	Vendor	Product	Version	Update	Edition	Language
Application	Python-ldap	Python-ldap	All	All	All	All

Reference	Source	Link	Tags
IBM X-Force Exchange	MISC	exchange.xforce.ibmcloud.com
ReDoS in LDAP schema parser (GHSL-2021-117 #424) · Advisory · python-ldap/python-ldap · GitHub	MISC	github.com
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

184730 Debian Security Update for python-ldap (CVE-2021-46823)
198853 Ubuntu Security Notification for Python LDAP Vulnerability (USN-5508-1)
296086 Oracle Solaris 11.4 Support Repository Update (SRU) 51.132.1 Missing (CPUOCT2022)
672273 EulerOS Security Update for python-ldap (EulerOS-SA-2022-2694)
672290 EulerOS Security Update for python-ldap (EulerOS-SA-2022-2662)
672387 EulerOS Security Update for python-ldap (EulerOS-SA-2022-2739)
672397 EulerOS Security Update for python-ldap (EulerOS-SA-2022-2774)
902358 Common Base Linux Mariner (CBL-Mariner) Security Update for python-ldap (9960)
907329 Common Base Linux Mariner (CBL-Mariner) Security Update for python-ldap (9960-1)