[Issue 10459] New: Potential Null Pointer Dereference vulnerability in libraries/libldap/ldifutil.c
https://bugs.openldap.org/show_bug.cgi?id=10459
Issue ID: 10459 Summary: Potential Null Pointer Dereference vulnerability in libraries/libldap/ldifutil.c Product: OpenLDAP Version: unspecified Hardware: All OS: All Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: 270186678@qq.com Target Milestone: ---
Created attachment 1119 --> https://bugs.openldap.org/attachment.cgi?id=1119&action=edit npd vulnerability triggering steps
Hello,
I found a potential null pointer dereference in the function `ldap_parse_ldif_record_x` in `libraries/libldap/ldifutil.c`.
The steps to trigger the issue are provided in the attached file (`npd vulnerability triggering steps.png`).
Could you please help confirm whether this is a valid issue?
Thank you for your time.
https://bugs.openldap.org/show_bug.cgi?id=10459
Howard Chu hyc@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Resolution|--- |INVALID Status|UNCONFIRMED |RESOLVED
--- Comment #1 from Howard Chu hyc@openldap.org --- That flag is only set by a syncrepl consumer replicating from Sun DSEE. It's a pretty uncommon configuration these days since DSEE was EOL years ago.
https://bugs.openldap.org/show_bug.cgi?id=10459
--- Comment #2 from 270186678@qq.com --- (In reply to Howard Chu from comment #1)
That flag is only set by a syncrepl consumer replicating from Sun DSEE. It's a pretty uncommon configuration these days since DSEE was EOL years ago.
Thanks, that makes sense!
https://bugs.openldap.org/show_bug.cgi?id=10459
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Keywords|needs_review | Status|RESOLVED |VERIFIED
-
openldap-its＠openldap.org