CVE-2020-25692: 
NixOS vulnerability analysis and mitigation

A NULL pointer dereference vulnerability (CVE-2020-25692) was discovered in OpenLDAP server versions prior to 2.4.55. The vulnerability was identified during a request for renaming RDNs and was fixed in OpenLDAP 2.4.55. This security flaw affects the server-side components only, not the client components (Red Hat, NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The technical assessment indicates that the vulnerability can be exploited remotely with low attack complexity, requires no privileges or user interaction, and has a significant impact on system availability (NetApp Advisory).

When successfully exploited, this vulnerability allows an unauthenticated attacker to remotely crash the slapd process by sending a specially crafted request, resulting in a Denial of Service (DoS) condition (NVD).

The vulnerability can be exploited remotely by an unauthenticated attacker through a specially crafted request. Public discussions of this vulnerability have been acknowledged by security vendors (NetApp Advisory).

The vulnerability was fixed in OpenLDAP version 2.4.55. Various vendors have released patches and updates to address this vulnerability. Red Hat has addressed this issue in Red Hat Enterprise Linux 7 through RHSA-2021:1389 (Red Hat). The upstream fix can be found in the OpenLDAP 2.4 branch commit 4c774220a752bf8e3284984890dc0931fe73165d.