Read the docs
TI-2008-02826 Aliases CVE-2008-2952GHSA-mgjr-3gvp-wpc2

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of…

Priority LOW 37CWE-399Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-399 and the CVSS impact.

Summary

liblber/io.c in OpenLDAP 2.2.4 to 2.4.10 allows remote attackers to cause a denial of service (program termination) via crafted ASN.1 BER datagrams that trigger an assertion error.

Why it matters now

EPSS 0.13173 96th percentileScored 2026-11-07
Fix Fixed Red Hat: 1 advisory

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 47

CPEVersionsRoleVendor
cpe:2.3:a:openldap:openldap:2.2.4:*:*:*:*:*:*:*2.2.4Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.2.5:*:*:*:*:*:*:*2.2.5Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.2.6:*:*:*:*:*:*:*2.2.6Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.2.7:*:*:*:*:*:*:*2.2.7Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.2.8:*:*:*:*:*:*:*2.2.8Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.2.9:*:*:*:*:*:*:*2.2.9Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.4:*:*:*:*:*:*:*2.3.4Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.5:*:*:*:*:*:*:*2.3.5Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.6:*:*:*:*:*:*:*2.3.6Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.7:*:*:*:*:*:*:*2.3.7Vulnerableopenldap
  • cpe:2.3:a:openldap:openldap:2.2.4:*:*:*:*:*:*:* Versions 2.2.4 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.2.5:*:*:*:*:*:*:* Versions 2.2.5 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.2.6:*:*:*:*:*:*:* Versions 2.2.6 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.2.7:*:*:*:*:*:*:* Versions 2.2.7 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.2.8:*:*:*:*:*:*:* Versions 2.2.8 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.2.9:*:*:*:*:*:*:* Versions 2.2.9 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.5:*:*:*:*:*:*:* Versions 2.3.5 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.6:*:*:*:*:*:*:* Versions 2.3.6 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.7:*:*:*:*:*:*:* Versions 2.3.7 Vulnerable ·openldap
Show 37 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:openldap:openldap:2.3.8:*:*:*:*:*:*:*2.3.8Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.9:*:*:*:*:*:*:*2.3.9Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.10:*:*:*:*:*:*:*2.3.10Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.11:*:*:*:*:*:*:*2.3.11Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.12:*:*:*:*:*:*:*2.3.12Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.13:*:*:*:*:*:*:*2.3.13Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.14:*:*:*:*:*:*:*2.3.14Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.15:*:*:*:*:*:*:*2.3.15Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.16:*:*:*:*:*:*:*2.3.16Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.17:*:*:*:*:*:*:*2.3.17Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.18:*:*:*:*:*:*:*2.3.18Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.19:*:*:*:*:*:*:*2.3.19Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.20:*:*:*:*:*:*:*2.3.20Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.21:*:*:*:*:*:*:*2.3.21Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.22:*:*:*:*:*:*:*2.3.22Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.23:*:*:*:*:*:*:*2.3.23Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.24:*:*:*:*:*:*:*2.3.24Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.25:*:*:*:*:*:*:*2.3.25Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.26:*:*:*:*:*:*:*2.3.26Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.27:*:*:*:*:*:*:*2.3.27Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.28:*:*:*:*:*:*:*2.3.28Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.29:*:*:*:*:*:*:*2.3.29Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.30:*:*:*:*:*:*:*2.3.30Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.31:*:*:*:*:*:*:*2.3.31Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.32:*:*:*:*:*:*:*2.3.32Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.33:*:*:*:*:*:*:*2.3.33Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.34:*:*:*:*:*:*:*2.3.34Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.35:*:*:*:*:*:*:*2.3.35Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.36:*:*:*:*:*:*:*2.3.36Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.37:*:*:*:*:*:*:*2.3.37Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.38:*:*:*:*:*:*:*2.3.38Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.39:*:*:*:*:*:*:*2.3.39Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.40:*:*:*:*:*:*:*2.3.40Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.41:*:*:*:*:*:*:*2.3.41Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.42:*:*:*:*:*:*:*2.3.42Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.3.43:*:*:*:*:*:*:*2.3.43Vulnerableopenldap
cpe:2.3:a:openldap:openldap:2.4.10:*:*:*:*:*:*:*2.4.10Vulnerableopenldap
  • cpe:2.3:a:openldap:openldap:2.3.8:*:*:*:*:*:*:* Versions 2.3.8 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.16:*:*:*:*:*:*:* Versions 2.3.16 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.17:*:*:*:*:*:*:* Versions 2.3.17 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.18:*:*:*:*:*:*:* Versions 2.3.18 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.19:*:*:*:*:*:*:* Versions 2.3.19 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.20:*:*:*:*:*:*:* Versions 2.3.20 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.21:*:*:*:*:*:*:* Versions 2.3.21 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.22:*:*:*:*:*:*:* Versions 2.3.22 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.23:*:*:*:*:*:*:* Versions 2.3.23 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.24:*:*:*:*:*:*:* Versions 2.3.24 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.25:*:*:*:*:*:*:* Versions 2.3.25 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.26:*:*:*:*:*:*:* Versions 2.3.26 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.27:*:*:*:*:*:*:* Versions 2.3.27 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.28:*:*:*:*:*:*:* Versions 2.3.28 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.29:*:*:*:*:*:*:* Versions 2.3.29 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.30:*:*:*:*:*:*:* Versions 2.3.30 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.31:*:*:*:*:*:*:* Versions 2.3.31 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.32:*:*:*:*:*:*:* Versions 2.3.32 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.33:*:*:*:*:*:*:* Versions 2.3.33 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.34:*:*:*:*:*:*:* Versions 2.3.34 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.35:*:*:*:*:*:*:* Versions 2.3.35 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.36:*:*:*:*:*:*:* Versions 2.3.36 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.37:*:*:*:*:*:*:* Versions 2.3.37 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.38:*:*:*:*:*:*:* Versions 2.3.38 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.39:*:*:*:*:*:*:* Versions 2.3.39 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.40:*:*:*:*:*:*:* Versions 2.3.40 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.41:*:*:*:*:*:*:* Versions 2.3.41 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.42:*:*:*:*:*:*:* Versions 2.3.42 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.3.43:*:*:*:*:*:*:* Versions 2.3.43 Vulnerable ·openldap
  • cpe:2.3:a:openldap:openldap:2.4.10:*:*:*:*:*:*:* Versions 2.4.10 Vulnerable ·openldap

Remediation

Red Hat 1 advisory

  • RHSA-2008:0583 Released 2008-07-09 · Red Hat rating Important
    openldap security update
    • Red Hat Enterprise Linux (v. 5 server) compat-openldap-2.3.27_2.2.29-8.el5_2.4, compat-openldap-2.3.27_2.2.29-8.el5_2.4.i386, compat-openldap-2.3.27_2.2.29-8.el5_2.4.ia64 +21
    • Red Hat Enterprise Linux AS version 4 compat-openldap-2.1.30-8.el4_6.5, compat-openldap-2.1.30-8.el4_6.5.i386, compat-openldap-2.1.30-8.el4_6.5.ia64 +21
    • Red Hat Enterprise Linux Desktop (v. 5 client) compat-openldap-2.3.27_2.2.29-8.el5_2.4, compat-openldap-2.3.27_2.2.29-8.el5_2.4.i386, openldap-2.3.27-8.el5_2.4 +3
    • Red Hat Enterprise Linux Desktop Workstation (v. 5 client) openldap-2.3.27-8.el5_2.4, openldap-devel-2.3.27-8.el5_2.4, openldap-devel-2.3.27-8.el5_2.4.i386 +4
    • Red Hat Enterprise Linux Desktop version 4 compat-openldap-2.1.30-8.el4_6.5, compat-openldap-2.1.30-8.el4_6.5.i386, openldap-2.2.13-8.el4_6.5 +9
    • Red Hat Enterprise Linux ES version 4 compat-openldap-2.1.30-8.el4_6.5, compat-openldap-2.1.30-8.el4_6.5.i386, compat-openldap-2.1.30-8.el4_6.5.ia64 +15
    • Red Hat Enterprise Linux WS version 4 compat-openldap-2.1.30-8.el4_6.5, compat-openldap-2.1.30-8.el4_6.5.i386, compat-openldap-2.1.30-8.el4_6.5.ia64 +15

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux (v. 5 server)Fixed RHSA-2008:0583
Red Hat Enterprise Linux AS version 4Fixed RHSA-2008:0583
Red Hat Enterprise Linux Desktop (v. 5 client)Fixed RHSA-2008:0583
Red Hat Enterprise Linux Desktop Workstation (v. 5 client)Fixed RHSA-2008:0583
Red Hat Enterprise Linux Desktop version 4Fixed RHSA-2008:0583
Red Hat Enterprise Linux ES version 4Fixed RHSA-2008:0583
Red Hat Enterprise Linux WS version 4Fixed RHSA-2008:0583

Timeline

  1. 2026-10-02 Threatist record created from CVE-2008-2952
  2. 2026-10-03 Alias added: GHSA-mgjr-3gvp-wpc2

References

Advisory 11

Other 8

  • TI-2022-11700 In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability… CVSS 3.1CRITICAL 9.8
  • TI-2020-18548 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in… CVSS 3.1HIGH 7.5
  • TI-2020-18541 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in… CVSS 3.1HIGH 7.5
  • TI-2020-18547 A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with… CVSS 3.1HIGH 7.5
  • TI-2020-18542 A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd… CVSS 3.1HIGH 7.5
  • TI-2006-05563 OpenLDAP before 2.3.29 allows remote attackers to cause a denial of service (daemon… CVSS 3.1HIGH 7.5
See all 58 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences