Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 619022 - net-nds/openldap: Long list of acceptable CA names breaks encryption
Summary: net-nds/openldap: Long list of acceptable CA names breaks encryption
Status: RESOLVED FIXED
Alias: None
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: http://www.openldap.org/software/rele...
Whiteboard: B3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2017-05-20 08:39 UTC by Agostino Sarubbo
Modified: 2020-04-16 06:37 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2017-05-20 08:39:18 UTC 
From ${URL} :

It was found that using openldap with a long list of acceptable CA names might break encryption. Sending the credentials while the handshake 
is complete would cause them to go out unencrypted.

References:

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=861838


@maintainer(s): after the bump, in case we need to stabilize the package, please let us know if it is ready for the stabilization or not.
Comment 1 Dimitris Nakos (sokan) 2018-05-28 12:41:41 UTC 
@maintainer(s):

A patch is available: http://www.openldap.org/devel/gitweb.cgi?p=openldap.git;a=commitdiff;h=7b5181da8cdd47a13041f9ee36fa9590a0fa6e48.
It has been merged in debian version 2.4.45+dfsg-1.

Demetris Nakos
-- Gentoo Security Padawan --
Comment 2 Pacho Ramos gentoo-dev 2019-11-10 16:07:28 UTC 
this is probably fixed in current stable versions
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-19 04:11:17 UTC 
(In reply to Pacho Ramos from comment #2)
> this is probably fixed in current stable versions

Patch: https://git.openldap.org/openldap/openldap/-/commit/7b5181da8cdd47a13041f9ee36fa9590a0fa6e48

looks like it landed in 2.4.46:
>Fixed libldap GnuTLS with GNUTLS_E_AGAIN (ITS#8650)

so tree is clean.
Comment 4 Yury German Gentoo Infrastructure gentoo-dev 2020-04-16 06:37:41 UTC 
GLSA Vote: No
Thank you all for you work. 
Closing as [noglsa].