RHBA-2012:0453 - Bug Fix Advisory

Topic

Updated openldap packages that fix three bugs are now available for Red Hat
Enterprise Linux 6 Extended Update Support.

Description

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol)
applications and development tools. LDAP is a set of protocols for accessing
directory services (usually phone book style information, but other information
is possible) over the Internet, similar to the way DNS (Domain Name System)
information is propagated over the Internet. The openldap package contains
configuration files, libraries, and documentation for OpenLDAP.

This update fixes the following bugs:

• Mozilla NSS initialization functions are not implemented in a thread-safe way.

Therefore, if multiple TLS operations were performed simultaneously on an LDAP
server, a race condition between the TLS threads could occur. Consequently, the
LDAP server terminated unexpectedly with a segmentation fault. With this update,
a mutual exclusion (mutex) for Mozilla NSS initialization functions calls has
been added to the code, which prevents this situation from occurring. The LDAP
server no longer crashes when initializing a TLS connection. (BZ#790913)

• Previously, OpenLDAP used incorrect data types for storing the length of the

values used by the ODBC (Open Database Connectivity) interface in the SQL back
end implementation. As a consequence, the LDAP server terminated unexpectedly
with a segmentation fault after a few operations. This update modifies the code
to use the correct data types so that the LDAP server no longer crashes when
using the SQL back end. (BZ#790914)

• Previously, OpenLDAP did not properly handle wildcarded common names (for

example CN=*.example.com) in LDAP certificates. Therefore, when a program used
OpenLDAP for a secure SSL/TLS connection to an LDAP server using an LDAP
certificate with a wildcarded common name, the connection failed. With this
update, the code of OpenLDAP has been modified to properly test common names in
LDAP certificates so that a connection to the LDAP server now succeeds if the
wildcarded common name matches the server hostname.
(BZ#790915)

All users of openldap are advised to upgrade to these updated packages, which
fix these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant
to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red
Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.1 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 6.1 i386
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 6.1 s390x
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 6.1 ppc64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 x86_64
• Red Hat Enterprise Linux Server - Extended Update Support from RHUI 6.1 i386
• Red Hat Virtual Storage Appliance (from RHUI) 6.1 x86_64

Fixes

• BZ - 790913 - NSS_Init* functions are not thread safe
• BZ - 790914 - OpenLDAP 2.4.23 segfaults when using back-sql
• BZ - 790915 - matching wildcard hostnames in certificate Subject field does not work

CVEs

(none)

References

(none)