Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 719960 (CVE-2020-12243) - <net-nds/openldap-2.4.50: Denial of service via nested boolean expressions in LDAP search filters (CVE-2020-12243)
Summary: <net-nds/openldap-2.4.50: Denial of service via nested boolean expressions in...
Status: RESOLVED FIXED
Alias: CVE-2020-12243
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://bugs.openldap.org/show_bug.cg...
Whiteboard: B3 [noglsa cve]
Keywords:
Depends on:
Blocks: CVE-2017-17740
  Show dependency tree
 
Reported: 2020-04-28 19:59 UTC by Sam James
Modified: 2020-05-08 10:22 UTC (History)
1 user (show)

See Also:
Package list:
=net-nds/openldap-2.4.50 amd64 arm arm64 hppa ppc ppc64 s390 sparc x86
Runtime testing required: ---
nattka: sanity-check+

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-28 19:59:24 UTC 
Description:
"In filter.c in slapd in OpenLDAP before 2.4.50, LDAP search filters with nested boolean expressions can result in denial of service (daemon crash)."

Patch: https://git.openldap.org/openldap/openldap/-/commit/98464c11df8247d6a11b52e294ba5dd4f0380440
Comment 1 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-28 19:59:43 UTC 
@maintainer(s), please bump to 2.4.50.
Comment 2 Larry the Git Cow gentoo-dev 2020-05-02 23:14:58 UTC 
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=4bf2f1709bbb8b087c56a2e01ce735d0dac58c2b

commit 4bf2f1709bbb8b087c56a2e01ce735d0dac58c2b
Author:     Robin H. Johnson <robbat2@gentoo.org>
AuthorDate: 2020-05-02 23:12:26 +0000
Commit:     Robin H. Johnson <robbat2@gentoo.org>
CommitDate: 2020-05-02 23:12:26 +0000

    net-nds/openldap: bump for security CVE-2020-12243
    
    Also update mirrors to use HTTPS/HTTPS, because upstream's official
    download URL is a FTP site which seems to be broken.
    
    Bug: https://bugs.gentoo.org/641576
    Bug: https://bugs.gentoo.org/719960
    Signed-off-by: Robin H. Johnson <robbat2@gentoo.org>

 net-nds/openldap/Manifest               |   1 +
 net-nds/openldap/openldap-2.4.50.ebuild | 907 ++++++++++++++++++++++++++++++++
 2 files changed, 908 insertions(+)
Comment 3 Robin Johnson archtester Gentoo Infrastructure gentoo-dev Security 2020-05-02 23:19:13 UTC 
arches, please test and stabilize.

FEATURES='test' USE='use -minimal' emerge =openldap-2.4.50
Comment 4 NATTkA bot gentoo-dev 2020-05-02 23:20:30 UTC 
Unable to check for sanity:

> disallowed package spec (only = allowed): net-nds/openldap
Comment 5 Agostino Sarubbo gentoo-dev 2020-05-03 15:06:28 UTC 
arm stable
Comment 6 Agostino Sarubbo gentoo-dev 2020-05-03 19:11:00 UTC 
amd64 stable
Comment 7 Agostino Sarubbo gentoo-dev 2020-05-03 19:12:40 UTC 
sparc stable
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-05-04 06:25:57 UTC 
arm64 stable
Comment 9 Rolf Eike Beer archtester 2020-05-07 19:48:06 UTC 
hppa stable
Comment 10 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2020-05-08 10:17:46 UTC 
s390 stable
Comment 11 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2020-05-08 10:18:49 UTC 
x86 stable
Comment 12 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2020-05-08 10:19:14 UTC 
ppc stable
Comment 13 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2020-05-08 10:19:39 UTC 
ppc64 stable
Comment 14 Mikle Kolyada (RETIRED) archtester Gentoo Infrastructure gentoo-dev Security 2020-05-08 10:22:41 UTC 
GLSA vote: no.