Oval Definition:oval:org.opensuse.security:def:70357
Revision Date:2021-03-08Version:1
Title:Security update for openldap2 (Important)
Description:

This update for openldap2 fixes the following issues:

- bsc#1182408 CVE-2020-36230 - an assertion failure in slapd in the X.509 DN parsing in decode.c ber_next_element, resulting in denial of service. - bsc#1182411 CVE-2020-36229 - ldap_X509dn2bv crash in the X.509 DN parsing in ad_keystring, resulting in denial of service. - bsc#1182412 CVE-2020-36228 - integer underflow leading to crash in the Certificate List Exact Assertion processing, resulting in denial of service. - bsc#1182413 CVE-2020-36227 - infinite loop in slapd with the cancel_extop Cancel operation, resulting in denial of service. - bsc#1182416 CVE-2020-36225 - double free and slapd crash in the saslAuthzTo processing, resulting in denial of service. - bsc#1182417 CVE-2020-36224 - invalid pointer free and slapd crash in the saslAuthzTo processing, resulting in denial of service. - bsc#1182415 CVE-2020-36226 - memch->bv_len miscalculation and slapd crash in the saslAuthzTo processing, resulting in denial of service. - bsc#1182419 CVE-2020-36222 - assertion failure in slapd in the saslAuthzTo validation, resulting in denial of service. - bsc#1182420 CVE-2020-36221 - slapd crashes in the Certificate Exact Assertion processing, resulting in denial of service (schema_init.c serialNumberAndIssuerCheck). - bsc#1182418 CVE-2020-36223 - slapd crash in the Values Return Filter control handling, resulting in denial of service (double free and out-of-bounds read). - bsc#1182279 CVE-2021-27212 - an assertion failure in slapd can occur in the issuerAndThisUpdateCheck function via a crafted packet, resulting in a denial of service (daemon exit) via a short timestamp. This is related to schema_init.c and checkTime.
Family:unixClass:patch
Status:Reference(s):1173257
1174091
1182279
1182408
1182411
1182412
1182413
1182415
1182416
1182417
1182418
1182419
1182420
CVE-2019-20907
CVE-2020-14019
CVE-2020-36221
CVE-2020-36222
CVE-2020-36223
CVE-2020-36224
CVE-2020-36225
CVE-2020-36226
CVE-2020-36227
CVE-2020-36228
CVE-2020-36229
CVE-2020-36230
CVE-2021-27212
SUSE-SU-2020:2109-1
SUSE-SU-2020:2276-1
SUSE-SU-2021:0723-1
Platform(s):SUSE Linux Enterprise Module for Basesystem 15 SP2
SUSE Linux Enterprise Module for Desktop Applications 15 SP2
SUSE Linux Enterprise Server for SAP Applications 15
Product(s):
Definition Synopsis
  • SUSE Linux Enterprise Module for Basesystem 15 SP2 is installed
  • AND Package Information
  • python-rtslib-fb-2.1.73-3.3 is installed
  • OR python3-rtslib-fb-2.1.73-3.3 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Module for Desktop Applications 15 SP2 is installed
  • AND Package Information
  • python-2.7.17-7.41 is installed
  • OR python-tk-2.7.17-7.41 is installed
  • Definition Synopsis
  • SUSE Linux Enterprise Server for SAP Applications 15 is installed
  • AND Package Information
  • libldap-2_4-2-2.4.46-9.48.1 is installed
  • OR libldap-2_4-2-32bit-2.4.46-9.48.1 is installed
  • OR libldap-data-2.4.46-9.48.1 is installed
  • OR openldap2-2.4.46-9.48.1 is installed
  • OR openldap2-back-meta-2.4.46-9.48.1 is installed
  • OR openldap2-back-perl-2.4.46-9.48.1 is installed
  • OR openldap2-client-2.4.46-9.48.1 is installed
  • OR openldap2-devel-2.4.46-9.48.1 is installed
  • OR openldap2-devel-32bit-2.4.46-9.48.1 is installed
  • OR openldap2-devel-static-2.4.46-9.48.1 is installed
  • OR openldap2-ppolicy-check-password-1.2-9.48.1 is installed
  • BACK