CVE-2020-8023

01.09.2020, 12:15

A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 15-LTSS openldap2 versions prior to 2.4.46-9.31.1. SUSE Linux Enterprise Server for SAP 12-SP2 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 12-SP3 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server for SAP 15 openldap2 versions prior to 2.4.46-9.31.1. SUSE OpenStack Cloud 7 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud 8 openldap2 versions prior to 2.4.41-18.71.2. SUSE OpenStack Cloud Crowbar 8 openldap2 versions prior to 2.4.41-18.71.2. openSUSE Leap 15.1 openldap2 versions prior to 2.4.46-lp151.10.12.1. openSUSE Leap 15.2 openldap2 versions prior to 2.4.46-lp152.14.3.1.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	7.7 HIGH	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 19%

Affected Products (NVD)

Vendor	Product	Version
opensuse	openldap2	𝑥 < 2.4.41-18.71.2
opensuse	openldap2	𝑥 < 2.4.26-0.74.13.1
opensuse	openldap2	𝑥 < 2.4.46-9.31.1
opensuse	openldap2	𝑥 < 2.4.46-lp151.10.12.1

𝑥

= Vulnerable software versions

openSUSE / SLES Releases

openSUSE Product

Release

compat-libldap-2_3-0

suse enterprise sap 12 SP2	2.3.37-18.24.20.2 fixed
suse enterprise sap 12 SP3	2.3.37-18.24.20.2 fixed
suse enterprise sap 12 SP4	2.3.37-18.24.20.2 fixed
suse enterprise sap 12 SP5	2.3.37-18.24.20.2 fixed

libldap-2_4-2

suse enterprise desktop 15 SP1	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP2	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP3	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise desktop 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise desktop 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise desktop 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise sap 12 SP2	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP3	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP4	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP5	2.4.41-18.71.2 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise sap 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise sap 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise server 12 SP2	2.4.41-18.71.2 fixed
suse enterprise server 12 SP3	2.4.41-18.71.2 fixed
suse enterprise server 12 SP4	2.4.41-18.71.2 fixed
suse enterprise server 12 SP5	2.4.41-18.71.2 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise server 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise server 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise server 15 SP7	2.4.46-150600.23.21 fixed

libldap-2_4-2-32bit

suse enterprise desktop 15 SP1	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP2	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP3	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise desktop 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise desktop 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise desktop 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise sap 12 SP2	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP3	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP4	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP5	2.4.41-18.71.2 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise sap 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise sap 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise server 12 SP2	2.4.41-18.71.2 fixed
suse enterprise server 12 SP3	2.4.41-18.71.2 fixed
suse enterprise server 12 SP4	2.4.41-18.71.2 fixed
suse enterprise server 12 SP5	2.4.41-18.71.2 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise server 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise server 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise server 15 SP7	2.4.46-150600.23.21 fixed

libldap-data

suse enterprise desktop 15 SP1	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP2	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP3	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise desktop 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise desktop 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise desktop 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise sap 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise sap 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise server 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise server 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise server 15 SP7	2.4.46-150600.23.21 fixed

openldap2

suse enterprise desktop 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 12 SP2	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP3	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP4	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP5	2.4.41-18.71.2 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 12 SP2	2.4.41-18.71.2 fixed
suse enterprise server 12 SP3	2.4.41-18.71.2 fixed
suse enterprise server 12 SP4	2.4.41-18.71.2 fixed
suse enterprise server 12 SP5	2.4.41-18.71.2 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed

openldap2-back-meta

suse enterprise sap 12 SP2	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP3	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP4	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP5	2.4.41-18.71.2 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 12 SP2	2.4.41-18.71.2 fixed
suse enterprise server 12 SP3	2.4.41-18.71.2 fixed
suse enterprise server 12 SP4	2.4.41-18.71.2 fixed
suse enterprise server 12 SP5	2.4.41-18.71.2 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed

openldap2-back-perl

suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed

openldap2-client

suse enterprise desktop 15 SP1	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP2	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP3	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise desktop 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise desktop 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise desktop 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise sap 12 SP2	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP3	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP4	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP5	2.4.41-18.71.2 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise sap 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise sap 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise server 12 SP2	2.4.41-18.71.2 fixed
suse enterprise server 12 SP3	2.4.41-18.71.2 fixed
suse enterprise server 12 SP4	2.4.41-18.71.2 fixed
suse enterprise server 12 SP5	2.4.41-18.71.2 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise server 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise server 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise server 15 SP7	2.4.46-150600.23.21 fixed

openldap2-devel

suse enterprise desktop 15 SP1	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP2	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP3	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise desktop 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise desktop 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise desktop 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise sap 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise sap 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise server 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise server 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise server 15 SP7	2.4.46-150600.23.21 fixed

openldap2-devel-32bit

suse enterprise server 15

2.4.46-9.31.1

fixed

openldap2-devel-static

suse enterprise desktop 15 SP1	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP2	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP3	2.4.46-9.31.1 fixed
suse enterprise desktop 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise desktop 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise desktop 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise desktop 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP1	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP2	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP3	2.4.46-9.31.1 fixed
suse enterprise sap 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise sap 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise sap 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise sap 15 SP7	2.4.46-150600.23.21 fixed
suse enterprise server 15	2.4.46-9.31.1 fixed
suse enterprise server 15 SP1	2.4.46-9.31.1 fixed
suse enterprise server 15 SP2	2.4.46-9.31.1 fixed
suse enterprise server 15 SP3	2.4.46-9.31.1 fixed
suse enterprise server 15 SP4	2.4.46-150200.14.5.1 fixed
suse enterprise server 15 SP5	2.4.46-150200.14.11.2 fixed
suse enterprise server 15 SP6	2.4.46-150600.23.21 fixed
suse enterprise server 15 SP7	2.4.46-150600.23.21 fixed

openldap2-doc

suse enterprise sap 12 SP2	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP3	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP4	2.4.41-18.71.2 fixed
suse enterprise sap 12 SP5	2.4.41-18.71.2 fixed
suse enterprise server 12 SP2	2.4.41-18.71.2 fixed
suse enterprise server 12 SP3	2.4.41-18.71.2 fixed
suse enterprise server 12 SP4	2.4.41-18.71.2 fixed
suse enterprise server 12 SP5	2.4.41-18.71.2 fixed

openldap2-ppolicy-check-password

suse enterprise desktop 15 SP1	1.2-9.31.1 fixed
suse enterprise desktop 15 SP2	1.2-9.31.1 fixed
suse enterprise sap 12 SP2	1.2-18.71.2 fixed
suse enterprise sap 12 SP3	1.2-18.71.2 fixed
suse enterprise sap 12 SP4	1.2-18.71.2 fixed
suse enterprise sap 12 SP5	1.2-18.71.2 fixed
suse enterprise sap 15 SP1	1.2-9.31.1 fixed
suse enterprise sap 15 SP2	1.2-9.31.1 fixed
suse enterprise sap 15 SP3	1.2-9.31.1 fixed
suse enterprise server 12 SP2	1.2-18.71.2 fixed
suse enterprise server 12 SP3	1.2-18.71.2 fixed
suse enterprise server 12 SP4	1.2-18.71.2 fixed
suse enterprise server 12 SP5	1.2-18.71.2 fixed
suse enterprise server 15	1.2-9.31.1 fixed
suse enterprise server 15 SP1	1.2-9.31.1 fixed
suse enterprise server 15 SP2	1.2-9.31.1 fixed
suse enterprise server 15 SP3	1.2-9.31.1 fixed

Known Exploits!

Common Weakness Enumeration

CWE-349 - Acceptance of Extraneous Untrusted Data With Trusted Data
The software, when processing trusted data, accepts any untrusted data that is also included with the trusted data, treating the untrusted data as if it were trusted.

References

https://bugzilla.suse.com/show_bug.cgi?id=1172698