CVE-2020-8023: Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2
SUSE · SUSE Enterprise Storage 5
Vendor fix available · Affected: SUSE Enterprise Storage 5 · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 35% of scored CVEs
DescriptionCVE.org
A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterprise Server 11-SECURITY, SUSE Linux Enterprise Server 11-SP4-LTSS, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server 12-SP4, SUSE Linux Enterprise Server 12-SP5, SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 12-SP2, SUSE Linux Enterprise Server for SAP 12-SP3, SUSE Linux Enterprise Server for SAP 15, SUSE OpenStack Cloud 7, SUSE OpenStack Cloud 8, SUSE OpenStack Cloud Crowbar 8; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to escalate privileges from user ldap to root. This issue affects: SUSE Enterprise Storage 5 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Debuginfo 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Debuginfo 11-SP4 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Point of Sale 11-SP3 openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 11-SECURITY openldap2-client-openssl1 versions prior to 2.4.26-0.74.13.1. SUSE Linux Enterprise Server 11-SP4-LTSS openldap2 versions prior to 2.4.26-0.74.13.1,. SUSE Linux Enterprise Server 12-SP2-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP2-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-BCL openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP3-LTSS openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP4 openldap2 versions prior to 2.4.41-18.71.2. SUSE Linux Enterprise Server 12-SP5 openldap2 versions prior to 2.4.41-18.71.2.
Affected products20
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- SUSE · SUSE Enterprise Storage 5from openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Debuginfo 11-SP3from openldap2 before 2.4.26-0.74.13.1,
- SUSE · SUSE Linux Enterprise Debuginfo 11-SP4from openldap2 before 2.4.26-0.74.13.1,
- SUSE · SUSE Linux Enterprise Point of Sale 11-SP3from openldap2 before 2.4.26-0.74.13.1,
- SUSE · SUSE Linux Enterprise Server 11-SECURITYfrom openldap2-client-openssl1 before 2.4.26-0.74.13.1
- SUSE · SUSE Linux Enterprise Server 11-SP4-LTSSfrom openldap2 before 2.4.26-0.74.13.1,
- SUSE · SUSE Linux Enterprise Server 12-SP2-BCLfrom openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server 12-SP2-LTSSfrom openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server 12-SP3-BCLfrom openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server 12-SP3-LTSSfrom openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server 12-SP4from openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server 12-SP5from openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server 15-LTSSfrom openldap2 before 2.4.46-9.31.1
- SUSE · SUSE Linux Enterprise Server for SAP 12-SP2from openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server for SAP 12-SP3from openldap2 before 2.4.41-18.71.2
- SUSE · SUSE Linux Enterprise Server for SAP 15from openldap2 before 2.4.46-9.31.1
- SUSE · SUSE OpenStack Cloud 7from openldap2 before 2.4.41-18.71.2
- SUSE · SUSE OpenStack Cloud 8from openldap2 before 2.4.41-18.71.2
- SUSE · SUSE OpenStack Cloud Crowbar 8from openldap2 before 2.4.41-18.71.2
- openSUSE · openSUSE Leap 15.1from openldap2 before 2.4.46-lp151.10.12.1
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Vendor
- SUSE
- Published
- September 2020
CoverageNo articles yet
No CyberSIXT article names CVE-2020-8023 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.