RHBA-2015:1292 - Bug Fix Advisory

Topic

Updated openldap packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 6.

Description

OpenLDAP is an open-source suite of Lightweight Directory Access Protocol (LDAP)
applications and development tools. LDAP is a set of protocols used to access
and maintain distributed directory information services over an IP network. The
openldap packages contain configuration files, libraries, and documentation for
OpenLDAP.

The openldap packages have been upgraded to upstream version 2.4.40, which
provides a number of bug fixes and enhancements over the previous version.
(BZ#1147983)

This update also fixes the following bugs:

• Previously, openldap did not correctly handle when multiple processes

attempted to establish an encrypted connection at the same time. Consequently,
utilities, such as the nslcd service, could terminate unexpectedly with a
segmentation fault. Incorrect thread initialization code that caused this bug
has been fixed. As a result, utilities no longer crash when processes establish
multiple concurrent encrypted connections. (BZ#1144294)

• Previously, the server could terminate unexpectedly when processing SRV

records due to invalid memory access. The error that caused the invalid memory
access has been corrected, and the server no longer crashes when processing SRV
records. (BZ#1164369)

• Prior to this update, user data was deleted after updating openldap when the

slapd.conf file was used to store the configuration, but the slapd.d/ directory
also existed. This update fixes incorrect logic in the post-installation script,
and user data is no longer deleted in this situation. (BZ#1193519)

• The server sometimes terminated unexpectedly with a segmentation fault on IBM

Power Systems due to a regression. A code optimization that caused this problem
has been removed, preventing the segmentation fault from occurring. As a result,
the server no longer crashes in this situation. (BZ#1202696)

In addition, this update adds the following enhancements:

• This update introduces the Check Password extension for OpenLDAP, required for

PCI compliance. (BZ#1155390)

• Support for the TLS protocol version 1.1 and later has been added.

(BZ#1160467)

Users of openldap are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 1147983 - Rebase openldap to 2.4.40
• BZ - 1160467 - support TLS 1.1 and later
• BZ - 1164369 - openldap: crash in ldap_domain2hostlist when processing SRV records
• BZ - 1193519 - Updating openldap deletes database if slapd.conf is used
• BZ - 1202696 - ppc64: slaptest segfault in openldap-2.4.40

CVEs

• CVE-2014-8182

References

(none)