RHBA-2011:0673 - Bug Fix Advisory

Topic

Updated openldap packages that fix several bugs and add an enhancement are now
available.

Description

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access
Protocol) applications and development tools. LDAP is a set of
protocols for accessing directory services (usually phone book style
information, but other information is possible) over the Internet,
similar to the way DNS (Domain Name System) information is propagated
over the Internet. The openldap package contains configuration files,
libraries, and documentation for OpenLDAP.

This update addresses the following bugs:

• Move openldap libraries from /usr/lib to /lib. (BZ#548475)
• Init script is working wrong if database recovery is needed. (BZ#613966)
• Update list of modules in slapd.conf.bak. (BZ#630637)
• slapd init script gets stuck in an infinite loop. (BZ#644399)
• openldap-servers upgrade hangs or do not upgrade the database (BZ#685119)

As well, this update adds the following enhancement:

• The openldap packages were rebased (from 2.4.19 to 2.4.23), where

OpenLDAP crypto backend was changed from OpenSSL to Mozilla NSS. This
brings better certificates management and ability to use OpenLDAP with
FreeIPA. The transition should be seamless. OpenLDAP with Mozilla NSS
can use all of the PEM cert and key files, and other TLS configuration,
that OpenLDAP with OpenSSL used. (BZ#644077)

Users are advised to upgrade to these packages, which resolve these issues.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 548475 - move openldap libraries from /usr/lib to /lib
• BZ - 613966 - Init script is working wrong if database recovery is needed
• BZ - 616554 - Mozilla NSS - support use of self signed CA certs as server certs
• BZ - 616558 - Mozilla NSS - delay token auth until needed
• BZ - 630637 - update list of modules in slapd.conf.bak
• BZ - 644399 - slapd init script gets stuck in an infinite loop
• BZ - 652814 - openldap should ignore files not in the openssl c_hash format in cacertdir
• BZ - 652816 - TLS_CACERTDIR takes precedence over TLS_CACERT
• BZ - 652817 - crash when TLS_CACERTDIR contains a subdirectory
• BZ - 652819 - improve SSL/TLS log messages
• BZ - 652823 - ldapsearch -Z hangs server if starttls fails
• BZ - 669845 - Default encryption strength dropped in switch to using NSS
• BZ - 669846 - some server certificates refused with inadequate type error
• BZ - 671553 - openldap can't use TLS after a fork()
• BZ - 678105 - updated openldap breaks build of php-5.3.3-3.el6
• BZ - 680139 - Add symlinks into /usr/lib*/
• BZ - 684035 - NULL dereferences in openldap-nss-non-blocking.patch
• BZ - 685119 - openldap-servers upgrade hangs or do not upgrade the database
• BZ - 693716 - rpm -V fails when upgrading with openldap-devel installed

CVEs

(none)

References

(none)