From Red Hat Security Advisory 2015:2131 :

Updated openldap packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, and documentation for OpenLDAP.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. (CVE-2015-3276)

This issue was discovered by Martin Poole of the Red Hat Software Maintenance Engineering group.

The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one enhancement over the previous version :

* The ORDERING matching rules have been added to the ppolicy attribute type descriptions.

* The server no longer terminates unexpectedly when processing SRV records.

* Missing objectClass information has been added, which enables the user to modify the front-end configuration by standard means.

(BZ#1147982)

This update also fixes the following bugs :

* Previously, OpenLDAP did not properly handle a number of simultaneous updates. As a consequence, sending a number of parallel update requests to the server could cause a deadlock. With this update, a superfluous locking mechanism causing the deadlock has been removed, thus fixing the bug. (BZ#1125152)

* The httpd service sometimes terminated unexpectedly with a segmentation fault on the libldap library unload. The underlying source code has been modified to prevent a bad memory access error that caused the bug to occur. As a result, httpd no longer crashes in this situation. (BZ#1158005)

* After upgrading the system from Red Hat Enterprise Linux 6 to Red Hat Enterprise Linux 7, symbolic links to certain libraries unexpectedly pointed to locations belonging to the openldap-devel package. If the user uninstalled openldap-devel, the symbolic links were broken and the 'rpm -V openldap' command sometimes produced errors. With this update, the symbolic links no longer get broken in the described situation. If the user downgrades openldap to version 2.4.39-6 or earlier, the symbolic links might break. After such downgrade, it is recommended to verify that the symbolic links did not break. To do this, make sure the yum-plugin-verify package is installed and obtain the target libraries by running the 'rpm -V openldap' or 'yum verify openldap' command. (BZ#1230263)

In addition, this update adds the following enhancement :

* OpenLDAP clients now automatically choose the Network Security Services (NSS) default cipher suites for communication with the server. It is no longer necessary to maintain the default cipher suites manually in the OpenLDAP source code. (BZ#1245279)

All openldap users are advised to upgrade to these updated packages, which correct these issues and add this enhancement.

Updated openldap packages that fix one security issue, several bugs, and add one enhancement are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, and documentation for OpenLDAP.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. (CVE-2015-3276)

This issue was discovered by Martin Poole of the Red Hat Software Maintenance Engineering group.

The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one enhancement over the previous version :

* The ORDERING matching rules have been added to the ppolicy attribute type descriptions.

* The server no longer terminates unexpectedly when processing SRV records.

* Missing objectClass information has been added, which enables the user to modify the front-end configuration by standard means.

(BZ#1147982)

This update also fixes the following bugs :

* Previously, OpenLDAP did not properly handle a number of simultaneous updates. As a consequence, sending a number of parallel update requests to the server could cause a deadlock. With this update, a superfluous locking mechanism causing the deadlock has been removed, thus fixing the bug. (BZ#1125152)

* The httpd service sometimes terminated unexpectedly with a segmentation fault on the libldap library unload. The underlying source code has been modified to prevent a bad memory access error that caused the bug to occur. As a result, httpd no longer crashes in this situation. (BZ#1158005)

* After upgrading the system from Red Hat Enterprise Linux 6 to Red Hat Enterprise Linux 7, symbolic links to certain libraries unexpectedly pointed to locations belonging to the openldap-devel package. If the user uninstalled openldap-devel, the symbolic links were broken and the 'rpm -V openldap' command sometimes produced errors. With this update, the symbolic links no longer get broken in the described situation. If the user downgrades openldap to version 2.4.39-6 or earlier, the symbolic links might break. After such downgrade, it is recommended to verify that the symbolic links did not break. To do this, make sure the yum-plugin-verify package is installed and obtain the target libraries by running the 'rpm -V openldap' or 'yum verify openldap' command. (BZ#1230263)

In addition, this update adds the following enhancement :

* OpenLDAP clients now automatically choose the Network Security Services (NSS) default cipher suites for communication with the server. It is no longer necessary to maintain the default cipher suites manually in the OpenLDAP source code. (BZ#1245279)

All openldap users are advised to upgrade to these updated packages, which correct these issues and add this enhancement.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled.

This update should make OpenLDAP up to date with latest NSS, notably :

  - fix olcTLSProtocolMin handling

  - fix TLS_CIPHER_SUITE parsing

  - update a list of ciphers to fit latest NSS development

  - make use of NSS global settings for `DEFAULTS'     TLS_CIPHER_SUITE keyword 

Additionaly, slapd should start correctly after network is online, now.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - openldap: incorrect multi-keyword mode cipherstring parsing (CVE-2015-3276)

  - /usr/libexec/openldap/generate-server-cert.sh in openldap-servers sets weak permissions for the TLS     certificate, which allows local users to obtain the TLS certificate by leveraging a race condition between     the creation of the certificate, and the chmod to protect it. (CVE-2016-4984)

  - servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user     with access to search the directory can crash slapd by issuing a search including the Paged Results     control with a page size of 0. (CVE-2017-9287)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled. (CVE-2015-3276)

The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and one enhancement over the previous version :

  - The ORDERING matching rules have been added to the     ppolicy attribute type descriptions. * The server no     longer terminates unexpectedly when processing SRV     records. * Missing objectClass information has been     added, which enables the user to modify the front-end     configuration by standard means.

This update also fixes the following bugs :

  - Previously, OpenLDAP did not properly handle a number of     simultaneous updates. As a consequence, sending a number     of parallel update requests to the server could cause a     deadlock. With this update, a superfluous locking     mechanism causing the deadlock has been removed, thus     fixing the bug.

  - The httpd service sometimes terminated unexpectedly with     a segmentation fault on the libldap library unload. The     underlying source code has been modified to prevent a     bad memory access error that caused the bug to occur. As     a result, httpd no longer crashes in this situation.

  - After upgrading the system from Scientific Linux 6 to     Scientific Linux 7, symbolic links to certain libraries     unexpectedly pointed to locations belonging to the     openldap-devel package. If the user uninstalled     openldap- devel, the symbolic links were broken and the     'rpm -V openldap' command sometimes produced errors.
    With this update, the symbolic links no longer get     broken in the described situation. If the user     downgrades openldap to version 2.4.39-6 or earlier, the     symbolic links might break. After such downgrade, it is     recommended to verify that the symbolic links did not     break. To do this, make sure the yum-plugin-verify     package is installed and obtain the target libraries by     running the 'rpm -V openldap' or 'yum verify openldap'     command.

In addition, this update adds the following enhancement :

  - OpenLDAP clients now automatically choose the Network     Security Services (NSS) default cipher suites for     communication with the server. It is no longer necessary     to maintain the default cipher suites manually in the     OpenLDAP source code.

ID	Name	Product	Family	Published	Updated	Severity
87023	Oracle Linux 7 : openldap (ELSA-2015-2131)	Nessus	Oracle Linux Local Security Checks	11/24/2015	1/14/2021	high
87132	CentOS 7 : openldap (CESA-2015:2131)	Nessus	CentOS Local Security Checks	12/2/2015	1/4/2021	high
97149	Amazon Linux AMI : openldap (ALAS-2017-799)	Nessus	Amazon Linux Local Security Checks	2/15/2017	4/18/2018	medium
86970	RHEL 7 : openldap (RHSA-2015:2131)	Nessus	Red Hat Local Security Checks	11/20/2015	1/10/2020	high
96968	Fedora 25 : openldap (2017-ceb1b8659e)	Nessus	Fedora Local Security Checks	2/3/2017	1/6/2021	medium
198770	RHEL 6 : openldap (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	6/3/2024	6/3/2024	high
87566	Scientific Linux Security Update : openldap on SL7.x x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	12/22/2015	1/14/2021	medium

Detections

Analytics

Plugins Search

high

high

medium

high

medium

high

medium