Bug 39340 - openldap: Denial of service (4.0)
openldap: Denial of service (4.0)
Status: CLOSED FIXED
Product: UCS
Classification: Unclassified
Component: Security updates
UCS 4.0
Other Linux
: P2 normal (vote)
: UCS 4.0-3-errata
Assigned To: Arvid Requate
Felix Botner
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2015-09-14 16:45 CEST by Arvid Requate
Modified: 2015-09-23 17:13 CEST (History)
3 users (show)

See Also:
What kind of report is it?: ---
What type of bug is this?: ---
Who will be affected by this bug?: ---
How will those affected feel about the bug?: ---
User Pain:
Enterprise Customer affected?:
School Customer affected?:
ISV affected?:
Waiting Support:
Flags outvoted (downgraded) after PO Review:
Ticket number:
Bug group (optional): Security
Max CVSS v3 score:
requate: Patch_Available+


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Arvid Requate univentionstaff 2015-09-14 16:45:02 CEST
Another issue now fixed in 2.4.31-2+deb7u1:

* Denial of service by unauthenticated remote attackers (reachable assertion and application crash) via crafted BER data (CVE-2015-6908)
Comment 1 Arvid Requate univentionstaff 2015-09-14 17:53:54 CEST
The openldap package has been rebuilt in scope errata4.0-3 with the extracted Debian patch 96_ITS8240-remove-obsolete-assert.patch

Advisory: 2015-09-11-openldap.yaml

Note: currently we still support 4.0-2, the advisory has been updated accordingly.
Comment 2 Felix Botner univentionstaff 2015-09-15 17:37:47 CEST
OK - slapd (2.4.40-1.202.201509141730) with 96_ITS8240-remove-obsolete-assert
     in errata4.0-3
OK - YAML
Comment 3 Janek Walkenhorst univentionstaff 2015-09-23 17:13:05 CEST
<http://errata.software-univention.de/ucs/4.0/324.html>