CVE-2021-27212: 
NixOS vulnerability analysis and mitigation

In OpenLDAP through versions 2.4.57 and 2.5.x through 2.5.1alpha, a vulnerability was discovered in the Certificate List Exact Assertion validation functionality. The vulnerability is tracked as CVE-2021-27212 and was disclosed on February 13, 2021. The issue affects the slapd daemon component of OpenLDAP, specifically in the issuerAndThisUpdateCheck function (MITRE CVE, NVD).

The vulnerability manifests as an assertion failure in the slapd daemon's issuerAndThisUpdateCheck function when processing crafted packets containing a short timestamp. The issue is related to the schema_init.c and checkTime components. The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (High), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating it can be exploited remotely with no privileges or user interaction required (Ubuntu CVE).

When successfully exploited, this vulnerability results in a denial of service condition through the crash of the slapd daemon. The impact is limited to availability, with no effects on confidentiality or integrity of the system (NetApp Advisory).

The vulnerability can be exploited by an unauthenticated remote attacker by sending specially crafted packets to the target system. The exploitation requires sending a malformed packet containing a short timestamp to trigger the assertion failure in the issuerAndThisUpdateCheck function (Debian Security).

The vulnerability has been fixed in multiple versions across different distributions. OpenLDAP has released patches through commits 3539fc33 and 9badb734 to address the issue. Various Linux distributions have also released security updates: Debian fixed it in version 2.4.47+dfsg-3+deb10u6 for the stable distribution (buster), and Ubuntu has provided fixes across multiple releases (OpenLDAP Bug, Debian LTS).