Bug 51183 – openldap: security issue (4.4)

Bug 51183 - openldap: security issue (4.4)


Summary:	openldap: security issue (4.4)

Status:	CLOSED FIXED

Product:	UCS
Classification:	Unclassified
Component:	Security updates
Version:	UCS 4.4
Hardware:	Other Linux

Importance:	P5 normal (vote)
Target Milestone:	UCS 4.4-4-errata
Assigned To:	Arvid Requate
QA Contact:	Erik Damrose

URL:
Keywords:

Depends on:
Blocks:	51188
	Show dependency tree / graph

Reported:	2020-04-29 10:38 CEST by Arvid Requate
Modified:	2020-05-13 15:28 CEST (History)
CC List:	2 users (show)

See Also:
What kind of report is it?:	Security Issue
What type of bug is this?:	---
Who will be affected by this bug?:	---
How will those affected feel about the bug?:	---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional):
Max CVSS v3 score:	7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)

Attachments
https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440.patch (2.87 KB, patch) 2020-04-29 11:08 CEST, Arvid Requate	Details \| Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Arvid Requate

2020-04-29 10:38:04 CEST

As a followup to CVE-2020-10704 (Bug 51121) OpenLDAP has released version 2.4.50 which fixes the same issue in slapd (CVE-2020-12243).

Upstream Bug: https://bugs.openldap.org/show_bug.cgi?id=9202

Comment 1 Arvid Requate

2020-04-29 11:08:30 CEST

Created attachment 10341 [details]
https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440.patch

Comment 2 Arvid Requate

2020-04-29 15:57:02 CEST

r18826 | Upstream patch
r18827 | Source package patch must have .quilt file suffix
9dcb15eb01 | Advisory

Package: openldap
Version: 2.4.45+dfsg-1~bpo9+1A~4.4.0.202004291153
Branch: ucs_4.4-0
Scope: errata4.4-4

Comment 3 Erik Damrose

2020-05-12 11:00:04 CEST

OK: yaml
OK: announce_errata
OK: patch
OK~: piuparts; Report from piuparts shows "Processes are running inside chroot", but this is the case for previous openldap package builds as well
Verified

Comment 4 Erik Damrose

2020-05-13 15:28:25 CEST

<http://errata.software-univention.de/ucs/4.4/591.html>