Stack Overflow in Apache Directory LDAP API Before Bind
Apache Directory LDAP API versions 1.2.0 before 1.2.9 contain a stack overflow (CWE-121) in the server-side decoder. Before a client binds, it can send a deeply nested LDAP search filter that overflows the stack while the filter is decoded. CVSS 3.1 rates this 7.3 (high): the flaw is reachable over the network with low complexity, no privileges, and no user interaction, with low impact to confidentiality, integrity, and availability. Anyone running a service that uses the affected API to decode unauthenticated search filters is affected, including deployments of the library from 1.2.0 up to but not including 1.2.9. It is not listed in CISA KEV, and no public proof-of-concept is known.
What to do: Upgrade Apache Directory LDAP API to 1.2.9 or later. Until then, restrict network access to services that decode unauthenticated LDAP search filters with this library, and review logs for unusually deep or malformed filters from clients that have not bound.
| Product | Affected |
|---|---|
| Apache Directory LDAP API | 1.2.0 before 1.2.9 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Stack Overflow vulnerability in Apache Directory LDAP API. Before binding, a client can send a deeply nested search filter that overflows the stack in the server's decoder. This issue affects Apache Directory LDAP API: from 1.2.0 before 1.2.9. Users are recommended to upgrade to version 1.2.9, which fixes the issue.
Unbound clients can crash Apache Directory LDAP API before 1.2.9 with a deeply nested search filter.
Today 656 readers · 803 views · 606 reads · all time 158K views