4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
AV:N/AC:M/Au:N/C:N/I:N/A:P
0.94 High
EPSS
Percentile
99.1%
CentOS Errata and Security Advisory CESA-2014:0126
OpenLDAP is an open source suite of Lightweight Directory Access Protocol
(LDAP) applications and development tools. LDAP is a set of protocols used
to access and maintain distributed directory information services over an
IP network. The openldap package contains configuration files, libraries,
and documentation for OpenLDAP.
A denial of service flaw was found in the way the OpenLDAP server daemon
(slapd) performed reference counting when using the rwm (rewrite/remap)
overlay. A remote attacker able to query the OpenLDAP server could use this
flaw to crash the server by immediately unbinding from the server after
sending a search request. (CVE-2013-4449)
Red Hat would like to thank Michael Vishchers from Seven Principles AG for
reporting this issue.
This update also fixes the following bug:
All openldap users are advised to upgrade to these updated packages, which
contain backported patches to correct these issues.
Merged security bulletin from advisories:
https://lists.centos.org/pipermail/centos-announce/2014-February/082294.html
Affected packages:
openldap
openldap-clients
openldap-devel
openldap-servers
openldap-servers-sql
Upstream details at:
https://access.redhat.com/errata/RHSA-2014:0126
OS | Version | Architecture | Package | Version | Filename |
---|---|---|---|---|---|
CentOS | 6 | i686 | openldap | < 2.4.23-34.el6_5.1 | openldap-2.4.23-34.el6_5.1.i686.rpm |
CentOS | 6 | i686 | openldap-clients | < 2.4.23-34.el6_5.1 | openldap-clients-2.4.23-34.el6_5.1.i686.rpm |
CentOS | 6 | i686 | openldap-devel | < 2.4.23-34.el6_5.1 | openldap-devel-2.4.23-34.el6_5.1.i686.rpm |
CentOS | 6 | i686 | openldap-servers | < 2.4.23-34.el6_5.1 | openldap-servers-2.4.23-34.el6_5.1.i686.rpm |
CentOS | 6 | i686 | openldap-servers-sql | < 2.4.23-34.el6_5.1 | openldap-servers-sql-2.4.23-34.el6_5.1.i686.rpm |
CentOS | 6 | i686 | openldap | < 2.4.23-34.el6_5.1 | openldap-2.4.23-34.el6_5.1.i686.rpm |
CentOS | 6 | x86_64 | openldap | < 2.4.23-34.el6_5.1 | openldap-2.4.23-34.el6_5.1.x86_64.rpm |
CentOS | 6 | x86_64 | openldap-clients | < 2.4.23-34.el6_5.1 | openldap-clients-2.4.23-34.el6_5.1.x86_64.rpm |
CentOS | 6 | i686 | openldap-devel | < 2.4.23-34.el6_5.1 | openldap-devel-2.4.23-34.el6_5.1.i686.rpm |
CentOS | 6 | x86_64 | openldap-devel | < 2.4.23-34.el6_5.1 | openldap-devel-2.4.23-34.el6_5.1.x86_64.rpm |