CVE-2020-25692

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-08 · updated 2026-10-14
Weakness: CWE-476

Description

A NULL pointer dereference was found in OpenLDAP server and was fixed in openldap 2.4.55, during a request for renaming RDNs. An unauthenticated attacker could remotely crash the slapd process by sending a specially crafted request, causing a Denial of Service.

Affected products

NetApp Cloud Backup: all versions
NetApp Solidfire Baseboard Management Controller Firmware: all versions
openldap: before 2.4.55 — fixed in 2.4.55
Red Hat Enterprise Linux: 5.0, 6.0, 7.0

How to fix

Upgrade to a fixed version: openldap 2.4.55. Check the vendor advisory for mitigations.

References

https://bugzilla.redhat.com/show_bug.cgi?id=1894567
https://security.netapp.com/advisory/ntap-20210108-0006/
https://bugzilla.redhat.com/show_bug.cgi?id=1894567
https://security.netapp.com/advisory/ntap-20210108-0006/
https://cert-portal.siemens.com/productcert/html/ssa-398330.html

Get alerted when CVE-2020-25692 or the next vulnerability affects your stack