UbuntuUpdates.org

Package "slapd"

Name: slapd

Description:

OpenLDAP server (slapd)
Latest version: 2.4.49+dfsg-2ubuntu1.10
Release: focal (20.04)
Level: security
Repository: main
Head package: openldap
Homepage: http://www.openldap.org/

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "slapd"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "slapd" in Focal

Repository Area Version
base main 2.4.49+dfsg-2ubuntu1
updates main 2.4.49+dfsg-2ubuntu1.10

Changelog

Version: 2.4.49+dfsg-2ubuntu1.10 2024-01-30 15:08:34 UTC

  openldap (2.4.49+dfsg-2ubuntu1.10) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via lack of strdup return code checking
    - debian/patches/CVE-2023-2953-1.patch: check for ber_strdup failure in
      libraries/libldap/fetch.c.
    - debian/patches/CVE-2023-2953-2.patch: check for strdup failure in
      libraries/libldap/url.c.
    - CVE-2023-2953

 -- Marc Deslauriers <email address hidden> Thu, 25 Jan 2024 13:43:43 -0500
Source diff to previous version
CVE-2023-2953 A vulnerability was found in openldap. This security flaw causes a null pointer dereference in ber_memalloc_x() function.

Version: 2.4.49+dfsg-2ubuntu1.9 2022-05-17 13:06:25 UTC

  openldap (2.4.49+dfsg-2ubuntu1.9) focal-security; urgency=medium

  * SECURITY UPDATE: SQL injection in experimental back-sql backend
    - debian/patches/CVE-2022-29155.patch: escape filter values in
      servers/slapd/back-sql/search.c.
    - CVE-2022-29155

 -- Marc Deslauriers <email address hidden> Thu, 12 May 2022 09:11:05 -0400
Source diff to previous version
CVE-2022-29155 In OpenLDAP 2.x before 2.5.12 and 2.6.x before 2.6.2, a SQL injection vulnerability exists in the experimental back-sql backend to slapd, via a SQL s

Version: 2.4.49+dfsg-2ubuntu1.7 2021-02-22 16:06:23 UTC

  openldap (2.4.49+dfsg-2ubuntu1.7) focal-security; urgency=medium

  * SECURITY UPDATE: DoS via malicious packet
    - debian/patches/CVE-2021-27212.patch: fix issuerAndThisUpdateCheck in
      servers/slapd/schema_init.c.
    - CVE-2021-27212

 -- Marc Deslauriers <email address hidden> Thu, 18 Feb 2021 09:22:15 -0500
Source diff to previous version
CVE-2021-27212 In OpenLDAP through 2.4.57 and 2.5.x through 2.5.1alpha, an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a craft

Version: 2.4.49+dfsg-2ubuntu1.6 2021-02-08 14:06:33 UTC

  openldap (2.4.49+dfsg-2ubuntu1.6) focal-security; urgency=medium

  * SECURITY UPDATE: integer underflow in Certificate Exact Assertion
    processing
    - debian/patches/CVE-2020-36221-1.patch: fix serialNumberAndIssuerCheck
      in servers/slapd/schema_init.c.
    - debian/patches/CVE-2020-36221-2.patch: fix serialNumberAndIssuerCheck
      in servers/slapd/schema_init.c.
    - CVE-2020-36221
  * SECURITY UPDATE: assert failure in saslAuthzTo validation
    - debian/patches/CVE-2020-36222-1.patch: remove saslauthz asserts in
      servers/slapd/saslauthz.c.
    - debian/patches/CVE-2020-36222-2.patch: fix debug msg in
      servers/slapd/saslauthz.c.
    - CVE-2020-36222
  * SECURITY UPDATE: crash in Values Return Filter control handling
    - debian/patches/CVE-2020-36223.patch: fix vrfilter double-free in
      servers/slapd/controls.c.
    - CVE-2020-36223
  * SECURITY UPDATE: DoS in saslAuthzTo processing
    - debian/patches/CVE-2020-36224-1.patch: use ch_free on normalized DN
      in servers/slapd/saslauthz.c.
    - debian/patches/CVE-2020-36224-2.patch: use slap_sl_free in prev
      commit in servers/slapd/saslauthz.c.
    - CVE-2020-36224
  * SECURITY UPDATE: DoS in saslAuthzTo processing
    - debian/patches/CVE-2020-36225.patch: fix AVA_Sort on invalid RDN in
      servers/slapd/dn.c.
    - CVE-2020-36225
  * SECURITY UPDATE: DoS in saslAuthzTo processing
    - debian/patches/CVE-2020-36226.patch: fix slap_parse_user in
      servers/slapd/saslauthz.c.
    - CVE-2020-36226
  * SECURITY UPDATE: infinite loop in cancel_extop Cancel operation
    - debian/patches/CVE-2020-36227.patch: fix cancel exop in
      servers/slapd/cancel.c.
    - CVE-2020-36227
  * SECURITY UPDATE: DoS in Certificate List Exact Assertion processing
    - debian/patches/CVE-2020-36228.patch: fix issuerAndThisUpdateCheck in
      servers/slapd/schema_init.c.
    - CVE-2020-36228
  * SECURITY UPDATE: DoS in X.509 DN parsing in ad_keystring
    - debian/patches/CVE-2020-36229.patch: add more checks to
      ldap_X509dn2bv in libraries/libldap/tls2.c.
    - CVE-2020-36229
  * SECURITY UPDATE: DoS in X.509 DN parsing in ber_next_element
    - debian/patches/CVE-2020-36230.patch: check for invalid BER after RDN
      count in libraries/libldap/tls2.c.
    - CVE-2020-36230

 -- Marc Deslauriers <email address hidden> Tue, 02 Feb 2021 11:06:34 -0500
Source diff to previous version
CVE-2020-36221 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to slapd crashes in the Certificate Exact Assertion processing, resulting in de
CVE-2020-36222 A flaw was discovered in OpenLDAP before 2.4.57 leading to an assertion failure in slapd in the saslAuthzTo validation, resulting in denial of servic
CVE-2020-36223 A flaw was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Values Return Filter control handling, resulting in denial of service
CVE-2020-36224 A flaw was discovered in OpenLDAP before 2.4.57 leading to an invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial
CVE-2020-36225 A flaw was discovered in OpenLDAP before 2.4.57 leading to a double free and slapd crash in the saslAuthzTo processing, resulting in denial of servic
CVE-2020-36226 A flaw was discovered in OpenLDAP before 2.4.57 leading to a memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in
CVE-2020-36227 A flaw was discovered in OpenLDAP before 2.4.57 leading to an infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of s
CVE-2020-36228 An integer underflow was discovered in OpenLDAP before 2.4.57 leading to a slapd crash in the Certificate List Exact Assertion processing, resulting
CVE-2020-36229 A flaw was discovered in ldap_X509dn2bv in OpenLDAP before 2.4.57 leading to a slapd crash in the X.509 DN parsing in ad_keystring, resulting in deni
CVE-2020-36230 A flaw was discovered in OpenLDAP before 2.4.57 leading in an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, result

Version: 2.4.49+dfsg-2ubuntu1.5 2020-11-17 15:06:21 UTC

  openldap (2.4.49+dfsg-2ubuntu1.5) focal-security; urgency=medium

  * SECURITY UPDATE: assertion failure in Certificate List syntax
    validation
    - debian/patches/CVE-2020-25709.patch: properly handle error in
      servers/slapd/schema_init.c.
    - CVE-2020-25709
  * SECURITY UPDATE: assertion failure in CSN normalization with invalid
    input
    - debian/patches/CVE-2020-25710.patch: properly handle error in
      servers/slapd/schema_init.c.
    - CVE-2020-25710

 -- Marc Deslauriers <email address hidden> Mon, 16 Nov 2020 08:39:57 -0500
CVE-2020-25709 assertion failure in Certificate List syntax validation
CVE-2020-25710 assertion failure in CSN normalization with invalid input


About   -   Send Feedback to @ubuntu_updates