There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

  - slapd in OpenLDAP 2.4.45 and earlier creates a PID file after dropping privileges to a non-root account,
    which might allow local users to kill arbitrary processes by leveraging access to this non-root account
    for PID file modification before a root script executes a "kill `cat /pathname`" command, as demonstrated
    by openldap-initscript. (CVE-2017-14159)

  - contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof
    overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote
    attackers to cause a denial of service (slapd crash) via a member MODDN operation. (CVE-2017-17740)

According to the versions of the openldap packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities :

  - An off-by-one error leading to a crash was discovered     in openldap 2.4 when processing DNS SRV messages. If     slapd was configured to use the dnssrv backend, an     attacker could crash the service with crafted DNS     responses.(CVE-2014-8182)

  - contrib/slapd-modules/nops/nops.c in OpenLDAP through     2.4.45, when both the nops module and the memberof     overlay are enabled, attempts to free a buffer that was     allocated on the stack, which allows remote attackers     to cause a denial of service (slapd crash) via a member     MODDN operation.(CVE-2017-17740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openldap2 fixes the following issues :

Security issues fixed :

CVE-2017-9287: A double free vulnerability in the mdb backend during search with page size 0 was fixed (bsc#1041764).

CVE-2017-17740: Fixed a denial of service (slapd crash) via a member MODDN operation that could have been triggered when both the nops module and the memberof overlay are enabled (bsc#1073313).

Non-security issues fixed: Fix a regression in handling of non-blocking connections (bsc#1031702)

Fix an uninitialised variable that causes startup failure (bsc#1037396)

Fix libldap leaks socket descriptors issue (bsc#1065083)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openldap2 fixes the following issues :

Security issue fixed :

  - CVE-2019-13565: Fixed an authentication bypass when     using SASL authentication and session encryption     (bsc#1143194).

  - CVE-2019-13057: Fixed an issue with delegated database     admin privileges (bsc#1143273).

  - CVE-2017-17740: When both the nops module and the member     of overlay are enabled, attempts to free a buffer that     was allocated on the stack, which allows remote     attackers to cause a denial of service (slapd crash) via     a member MODDN operation. (bsc#1073313)

Non-security issues fixed :

  - Fixed broken shebang line in     openldap_update_modules_path.sh (bsc#1114845).

  - Create files in /var/lib/ldap/ during initial start to     allow for transactional updates (bsc#1111388)

  - Fixed incorrect post script call causing tmpfiles     creation not to be run (bsc#1111388).

This update was imported from the SUSE:SLE-15:Update update project.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - contrib/slapd-modules/nops/nops.c in OpenLDAP through 2.4.45, when both the nops module and the memberof     overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote     attackers to cause a denial of service (slapd crash) via a member MODDN operation. (CVE-2017-17740)

Note that Nessus relies on the presence of the package as reported by the vendor.

This update for openldap2 fixes the following issues :

Security issue fixed :

CVE-2017-17740: When both the nops module and the memberof overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. (bsc#1073313)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for openldap2 fixes the following issues :

Security issue fixed :

CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194).

CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273).

CVE-2017-17740: When both the nops module and the member of overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. (bsc#1073313)

Non-security issues fixed: Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845).

Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388)

Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

According to the version of the openldap packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerability :

  - contrib/slapd-modules/nops/nops.c in OpenLDAP through     2.4.45, when both the nops module and the memberof     overlay are enabled, attempts to free a buffer that was     allocated on the stack, which allows remote attackers     to cause a denial of service (slapd crash) via a member     MODDN operation.(CVE-2017-17740)

Note that Tenable Network Security has extracted the preceding description block directly from the EulerOS security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
424283	Alpine: libldap, multiple openldap packages: security update to 2.4.46-r0	Tenable Cloud Security	Alpine Linux Local Security Checks	4/4/2025	7/2/2026	high
424283	Alpine: libldap, multiple openldap packages: security update to 2.4.46-r0	Tenable Self-Hosted Container Security	Alpine Linux Local Security Checks	4/4/2025	7/2/2026	high
134003	EulerOS 2.0 SP8 : openldap (EulerOS-SA-2020-1169)	Nessus	Huawei Local Security Checks	2/25/2020	3/26/2024	high
124018	SUSE SLES12 Security Update : openldap2 (SUSE-SU-2019:0931-1)	Nessus	SuSE Local Security Checks	4/12/2019	6/3/2024	high
129280	openSUSE Security Update : openldap2 (openSUSE-2019-2157)	Nessus	SuSE Local Security Checks	9/24/2019	12/24/2019	high
255626	Linux Distros Unpatched Vulnerability : CVE-2017-17740	Nessus	Misc.	8/26/2025	9/2/2026	high
119743	SUSE SLED12 / SLES12 Security Update : openldap2 (SUSE-SU-2018:4150-1)	Nessus	SuSE Local Security Checks	12/18/2018	7/15/2024	high
129043	SUSE SLED15 / SLES15 Security Update : openldap2 (SUSE-SU-2019:2395-1)	Nessus	SuSE Local Security Checks	9/19/2019	1/13/2021	high
129342	openSUSE Security Update : openldap2 (openSUSE-2019-2176)	Nessus	SuSE Local Security Checks	9/25/2019	1/19/2021	high
135140	EulerOS Virtualization for ARM 64 3.0.6.0 : openldap (EulerOS-SA-2020-1353)	Nessus	Huawei Local Security Checks	4/2/2020	3/20/2024	high

Detections

Analytics

Plugins Search

high

high

high

high

high

high

high

high

high

high