What’s Vulnerable › Vulnerabilities

CVE-2017-17740

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 7.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2017-12-18 · updated 2026-06-17
• Weakness: CWE-119

Description

contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation.

Affected products

• McAfee,LLC McAfee Policy Auditor: before 6.5.1 — fixed in 6.5.1
• openldap: through 2.4.45
• openSUSE Leap: 15.0, 15.1
• Oracle Blockchain Platform: before 21.1.2 — fixed in 21.1.2

How to fix

Upgrade to a fixed version: McAfee,LLC McAfee Policy Auditor 6.5.1; Oracle Blockchain Platform 21.1.2. Check the vendor advisory for mitigations.

References

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html
• http://www.openldap.org/its/index.cgi/Incoming?id=8759
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://www.oracle.com/security-alerts/cpuapr2022.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00053.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00058.html
• http://www.openldap.org/its/index.cgi/Incoming?id=8759
• https://kc.mcafee.com/corporate/index?page=content&id=SB10365
• https://www.oracle.com/security-alerts/cpuapr2022.html

Get alerted when CVE-2017-17740 or the next vulnerability affects your stack