SUSE-SU-2019:0931-1 | Mondoo Vulnerability Intelligence

SUSE-SU-2019:0931-1

MEDIUM6.5

Security update for openldap2

Published Apr 11, 2019

Modified 7 years ago

Fix available

Details

Description of the patch:

This update for openldap2 fixes the following issues:

Security issues fixed:

CVE-2017-9287: A double free vulnerability in the mdb backend during search with page size 0 was fixed (bsc#1041764).
CVE-2017-17740: Fixed a denial of service (slapd crash) via a member MODDN operation that could have been triggered when both the nops module and the memberof overlay are enabled (bsc#1073313).

Non-security issues fixed:

Fix a regression in handling of non-blocking connections (bsc#1031702)
Fix an uninitialised variable that causes startup failure (bsc#1037396)
Fix libldap leaks socket descriptors issue (bsc#1065083)

Affected Packages

compat-libldap-2_3-0

SUSE Linux Enterprise Module for Legacy 12SUSE Linux Enterprise Server for SAP Applications 12SUSE Linux Enterprise Server for SAP Applications 12 SP1SUSE Linux Enterprise Server for SAP Applications 12 SP2SUSE Linux Enterprise Server for SAP Applications 12 SP3

Fixed in:

2.3.37-18.24.9.7

libldap-2_4-2

SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12-LTSSSUSE Linux Enterprise Server for SAP Applications 12SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

2.4.41-18.24.9.1

libldap-2_4-2-32bit

SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12-LTSSSUSE Linux Enterprise Server for SAP Applications 12SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

2.4.41-18.24.9.1

openldap2

SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12-LTSSSUSE Linux Enterprise Server for SAP Applications 12SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

2.4.41-18.24.9.7

openldap2-back-meta

SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12-LTSSSUSE Linux Enterprise Server for SAP Applications 12SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

2.4.41-18.24.9.7

openldap2-client

SUSE Linux Enterprise Server 12 SP1-LTSSSUSE Linux Enterprise Server 12-LTSSSUSE Linux Enterprise Server for SAP Applications 12SUSE Linux Enterprise Server for SAP Applications 12 SP1

Fixed in:

2.4.41-18.24.9.1

References

https://bugzilla.suse.com/1031702

https://bugzilla.suse.com/1037396

https://bugzilla.suse.com/1041764

https://bugzilla.suse.com/1065083

https://bugzilla.suse.com/1073313

https://lists.suse.com/pipermail/sle-security-updates/2019-April/005325.html

https://www.suse.com/security/cve/CVE-2017-17740/

https://www.suse.com/security/cve/CVE-2017-9287/

https://www.suse.com/support/security/rating/

https://www.suse.com/support/update/announcement/2019/suse-su-20190931-1/

CVSS Analysis

CVSS v3.0

6.5

Exploitability

Attack Vector

NetworkAV:N

Attack Complexity

LowAC:L

Privileges Required

LowPR:L

User Interaction

NoneUI:N

Scope

Scope

UnchangedS:U

Impact

Confidentiality

NoneC:N

Integrity

NoneI:N

Availability

HighA:H

6.5/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Upstream

CVE-2017-17740 CVE-2017-9287

Ecosystems(8)

SUSE Linux Enterprise Module for Legacy 12 SUSE Linux Enterprise Server 12 SP1-LTSS SUSE Linux Enterprise Server 12-LTSS SUSE Linux Enterprise Server for SAP Applications 12 SUSE Linux Enterprise Server for SAP Applications 12 SP1

Timeline

PublishedApr 11, 2019

ModifiedApr 11, 2019