USN-7698-1: OpenLDAP vulnerabilities

It was discovered that OpenLDAP incorrectly handled Certificate Exact
Assertion processing. A remote attacker could possibly use this issue to
cause OpenLDAP to crash, resulting in a denial of service. (CVE-2020-36221)

It was discovered that OpenLDAP incorrectly handled saslAuthzTo processing.
A remote attacker could use this issue to cause OpenLDAP to crash,
resulting in a denial of service, or possibly execute arbitrary code.
(CVE-2020-36222, CVE-2020-36224, CVE-2020-36225, CVE-2020-36226)

It was discovered that OpenLDAP incorrectly handled Return Filter control
handling. A remote attacker could use this issue to cause OpenLDAP to
crash, resulting in a denial of service, or possibly execute arbitrary
code. (CVE-2020-36223)

It was discovered that OpenLDAP incorrectly handled certain cancel
operations. A remote attacker could possibly use this issue to cause
OpenLDAP to crash, resulting in a denial of service. (CVE-2020-36227)

It was discovered that OpenLDAP incorrectly handled Certificate List
Extract Assertion processing. A remote attacker could possibly use this
issue to cause OpenLDAP to crash, resulting in a denial of service.
(CVE-2020-36228)

nmap -sV --script vuln -p- <target-network>

tail -f /var/log/suricata/fast.log | grep <cve>

Check Vendor Security Advisory Bulletin

title: Detect Exploitation - USN-7698-1: OpenLDAP vulnerabilities
id: 586520f3-3e38-4a1e-b4e7-bbf4451d3c04
status: experimental
description: Automatisch generierte SIEM-Erkennungsregel basierend auf CTI Intelligence
references:
  - https://tsecurity.de/
author: iShareStuff CTI Automated Detection Engine
date: 2026-09-24
logsource:
  category: network_connection
  product: any
detection:
  selection:
      CommandLine|contains:
        - 'exploit'
  condition: selection
falsepositives:
  - Legitime administrative Zugriffe oder Penetrationstests
level: high
tags:
  - attack.initial_access

rule CTI_Threat_Indicator {
    meta:
        author = "iShareStuff CTI Automated Detection Engine"
        date = "2026-09-24"
        description = "YARA Signature for "
    strings:
        $str = "USN-7698-1: OpenLDAP vulnerabi" ascii wide
    condition:
        any of them
}