RHBA-2015:0333 - Bug Fix Advisory

Topic

An updated perl-LDAP package that fixes two bugs is now available for Red Hat Enterprise Linux 7.

Description

The perl-LDAP package provides a collection of modules that implements an LDAP services API for Perl programs. The module may be used to search directories or perform maintenance functions such as adding, deleting, or modifying entries.

This update fixes the following bugs:

• The Net::LDAP Perl module is used for connecting to an LDAP server. When the module was used without specifying a list of allowed Secure Sockets Layer (SSL) ciphers, the SSL client accepted all SSL ciphers, even those that were not enabled by default by the OpenSSL cryptographic library. With this update, Net::LDAP has been modified to not request all ciphers by default. As a result, LDAP clients now use the default OpenSSL list of allowed ciphers if not specified explicitly otherwise. (BZ#1091316)
• When using a Perl LDAP client with Simple Authentication and Security Layer (SASL) mechanism, the LDAP server could receive corrupted LDAP queries. This was because the Net::LDAP Perl module always passed an incorrect static value of 1500 bytes as a query length to the syswrite() function, which could be redefined by other protocol layers, such as SASL. The underlying source code has been modified to fix this bug, and Net::LDAP no longer sends corrupted LDAP queries to the server. (BZ#1104243)

Users of perl-LDAP are advised to upgrade to this updated package, which fixes these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 1091316 - Net::LDAP should not set ciphers to 'ALL' if not requested explicitly
• BZ - 1104243 - perl-LDAP sets wrong length for function _sendmesg

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal