CVE-2021-46823 Denial of Service in python-ldap
A remote authenticated attacker can cause a denial of service in python-ldap by sending crafted regex input to the schema parser.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-46823?
CVE-2021-46823 is a medium-severity denial of service vulnerability in n/a, published on 18 Jun 2022. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
python-ldap before 3.4.0 is vulnerable to a denial of service when ldap.schema is used for untrusted schema definitions, because of a regular expression denial of service (ReDoS) flaw in the LDAP schema parser. By sending crafted regex input, a remote authenticated attacker could exploit this vulnerability to cause a denial of service condition.
Weakness: CWE-1333
Which versions are affected by CVE-2021-46823?
5 open source packages ship an affected version, including python-ldap. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
python-ldap PyPI | All versions | 3.4.0 |
python-ldap PyPI | All versions | 3.4.0 |
python-ldap PyPI | All versions | 3.4.0 |
python-ldap PyPI | All versions | 3.4.0 |
python-ldap PyPI | All versions | 3.4.0 |
Products include Python-Ldap Python-Ldap.
How do I fix CVE-2021-46823?
Upgrade python-ldap to 3.4.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-46823 being exploited?
There is no known exploitation of CVE-2021-46823 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as AZL-9960, DEBIAN-CVE-2021-46823, GHSA-qfr5-wjpw-q4c4, GHSA-r8wq-qrxc-hmcm, MGASA-2022-0310, OESA-2022-1792 and 4 more.