Debian has issued an advisory on May 30: https://www.debian.org/security/2017/dsa-3868 The upstream patch is linked from the upstream bug: http://www.openldap.org/its/?findid=8655 Mageia 5 is also affected.
Whiteboard: (none) => MGA5TOO
Assigning to the registered maintainer.
CC: (none) => marja11Assignee: bugsquad => bgmilne
Fixed in cauldron
Version: Cauldron => 5Whiteboard: MGA5TOO => (none)CC: (none) => mageia
Pushed in updates_testing src.rpm: openldap-2.4.40-3.2.mga5
Assignee: bgmilne => qa-bugs
tests are failing, can someone take a look please ?
CC: (none) => qa-bugsAssignee: qa-bugs => bgmilne
RedHat updated it to a newer version for this issue: https://access.redhat.com/errata/RHSA-2017:1852 Maybe we could sync the Mageia 5 package with Mageia 6?
Pushed in updates_testing for mageia 5 src.rpm: openldap-2.4.45-1.mga5 can someone help with tests failing ?
Reassigning back to Nicolas as it's not ready for QA with tests failing.
Assignee: qa-bugs => mageia
Assignee: mageia => bgmilne
Since there's a systemd unit file for slapd, I don't think we can be vulnerable to CVE-2017-14159: http://seclists.org/oss-sec/2017/q3/427 but the SysV init script should be removed from the package.
I noticed that the test are disabled in mga6 as well. Guess we can QA this. Advisory: ======================== Updated openldap packages fix security vulnerability: A double-free flaw was found in the way OpenLDAP's slapd server using the MDB backend handled LDAP searches. A remote attacker with access to search the directory could potentially use this flaw to crash slapd by issuing a specially crafted LDAP search query (CVE-2017-9287). The openldap package has been updated to version 2.4.45 to fix this issue and other bugs. References: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9287 https://access.redhat.com/errata/RHSA-2017:1852
Assignee: bgmilne => qa-bugsCC: qa-bugs => (none)
To test normally.
Keywords: (none) => advisoryCC: (none) => davidwhodgins
As kerberos uses openldap, followed the qa procedure for krb5. $ klist Ticket cache: FILE:/tmp/krb5cc_500 Default principal: dave@X5V.HODGINS.HOMEIP.NET Valid starting Expires Service principal 03/01/18 07:33:15 04/01/18 07:33:15 krbtgt/X5V.HODGINS.HOMEIP.NET@X5V.HODGINS.HOMEIP.NET Validating the update.
Whiteboard: (none) => MGA5-64-OKKeywords: (none) => validated_updateCC: (none) => sysadmin-bugs
An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2018-0033.html
Resolution: (none) => FIXEDStatus: NEW => RESOLVED