CVE-2021-46823

A flaw was found in python-ldap. The vulnerability occurs due to a regular expression and leads to a denial of service attack. This flaw allows an attacker to parse LDAP schema definitions from an untrusted source, leading to a crash or code execution.

Red Hat Enterprise Linux 9.0.z is affected by this vulnerability as it includes the vulnerable version of python-ldap (3.3.1). However, the issue was resolved in Red Hat Enterprise Linux 9.2 and later via RHEA-2023:2359, which rebased python-ldap to version 3.4.3 containing the upstream fix. Red Hat Enterprise Linux 10 is not affected, as it does not ship the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Check input for an excessive amount of backslashes in schemas. More than a dozen backslashes per line are atypical.