Issued:

2015-07-22

Updated:

2015-07-22

RHBA-2015:1292 - openldap bug fix and enhancement update

Synopsis

openldap bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Topic

Updated openldap packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 6.

Description

OpenLDAP is an open-source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, and documentation for OpenLDAP.

The openldap packages have been upgraded to upstream version 2.4.40, which provides a number of bug fixes and enhancements over the previous version. (BZ#1147983)

This update also fixes the following bugs:

• Previously, openldap did not correctly handle when multiple processes attempted to establish an encrypted connection at the same time. Consequently, utilities, such as the nslcd service, could terminate unexpectedly with a segmentation fault. Incorrect thread initialization code that caused this bug has been fixed. As a result, utilities no longer crash when processes establish multiple concurrent encrypted connections. (BZ#1144294)

• Previously, the server could terminate unexpectedly when processing SRV records due to invalid memory access. The error that caused the invalid memory access has been corrected, and the server no longer crashes when processing SRV records. (BZ#1164369)

• Prior to this update, user data was deleted after updating openldap when the slapd.conf file was used to store the configuration, but the slapd.d/ directory also existed. This update fixes incorrect logic in the post-installation script, and user data is no longer deleted in this situation. (BZ#1193519)

• The server sometimes terminated unexpectedly with a segmentation fault on IBM Power Systems due to a regression. A code optimization that caused this problem has been removed, preventing the segmentation fault from occurring. As a result, the server no longer crashes in this situation. (BZ#1202696)

In addition, this update adds the following enhancements:

• This update introduces the Check Password extension for OpenLDAP, required for PCI compliance. (BZ#1155390)

• Support for the TLS protocol version 1.1 and later has been added. (BZ#1160467)

Users of openldap are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• openldap-debuginfo-2.4.40-5.el6.ppc64.rpm
• openldap-servers-2.4.40-5.el6.s390x.rpm
• openldap-servers-2.4.40-5.el6.i686.rpm
• openldap-servers-2.4.40-5.el6.ppc64.rpm
• openldap-devel-2.4.40-5.el6.i686.rpm
• openldap-2.4.40-5.el6.s390.rpm
• openldap-servers-2.4.40-5.el6.x86_64.rpm
• openldap-2.4.40-5.el6.ppc64.rpm
• openldap-debuginfo-2.4.40-5.el6.i686.rpm
• openldap-debuginfo-2.4.40-5.el6.x86_64.rpm
• openldap-devel-2.4.40-5.el6.s390.rpm
• openldap-clients-2.4.40-5.el6.i686.rpm
• openldap-2.4.40-5.el6.src.rpm
• openldap-debuginfo-2.4.40-5.el6.s390.rpm
• openldap-2.4.40-5.el6.x86_64.rpm
• openldap-debuginfo-2.4.40-5.el6.ppc.rpm
• openldap-clients-2.4.40-5.el6.x86_64.rpm
• openldap-devel-2.4.40-5.el6.ppc64.rpm
• openldap-2.4.40-5.el6.i686.rpm
• openldap-devel-2.4.40-5.el6.ppc.rpm
• openldap-servers-sql-2.4.40-5.el6.s390x.rpm
• openldap-clients-2.4.40-5.el6.s390x.rpm
• openldap-servers-sql-2.4.40-5.el6.x86_64.rpm
• openldap-servers-sql-2.4.40-5.el6.ppc64.rpm
• openldap-clients-2.4.40-5.el6.ppc64.rpm
• openldap-devel-2.4.40-5.el6.s390x.rpm
• openldap-2.4.40-5.el6.s390x.rpm
• openldap-debuginfo-2.4.40-5.el6.s390x.rpm
• openldap-2.4.40-5.el6.ppc.rpm
• openldap-servers-sql-2.4.40-5.el6.i686.rpm
• openldap-devel-2.4.40-5.el6.x86_64.rpm

Fixes

• This content is not included.BZ - 1147983
• This content is not included.BZ - 1160467
• This content is not included.BZ - 1164369
• This content is not included.BZ - 1193519
• This content is not included.BZ - 1202696

CVEs

• CVE-2014-8182

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at Security Contacts and Procedures.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.