openSUSE openldap2 vulnerabilities

Latest openSUSE openldap2 CVEs

Newest publication first

1. CVE-2022-31253 openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself

   Published 2022-11-09

   High·CVSS 7.8 EPSS 0.35%

   A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap...

2. CVE-2020-8027 openldap uses fixed paths in /tmp

   Published 2021-02-11

   Medium·CVSS 6.6 EPSS 0.31%

   A Insecure Temporary File vulnerability in openldap2 of SUSE Linux Enterprise Server 15-LTSS, SUSE Linux Enterprise Server for SAP 15; openSUSE Leap 15.1, openSUSE Leap 15.2 allows local attackers to overwrite arbitrary files and gain access to the openldap2 configuration This is...

3. CVE-2020-8023 Local privilege escalation from ldap to root when using OPENLDAP_CONFIG_BACKEND=ldap in openldap2

   Published 2020-09-01

   High·CVSS 7.8 EPSS 0.41%

   A acceptance of Extraneous Untrusted Data With Trusted Data vulnerability in the start script of openldap2 of SUSE Enterprise Storage 5, SUSE Linux Enterprise Debuginfo 11-SP3, SUSE Linux Enterprise Debuginfo 11-SP4, SUSE Linux Enterprise Point of Sale 11-SP3, SUSE Linux Enterpri...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.