SUSE-SU-2019:2395-1

Dashboard / Vulnerabilities / SUSE-SU-2019:2395-1

SUSE-SU-2019:2395-1

Summary: Security update for openldap2

Details: This update for openldap2 fixes the following issues: Security issue fixed: - CVE-2019-13565: Fixed an authentication bypass when using SASL authentication and session encryption (bsc#1143194). - CVE-2019-13057: Fixed an issue with delegated database admin privileges (bsc#1143273). - CVE-2017-17740: When both the nops module and the member of overlay are enabled, attempts to free a buffer that was allocated on the stack, which allows remote attackers to cause a denial of service (slapd crash) via a member MODDN operation. (bsc#1073313) Non-security issues fixed: - Fixed broken shebang line in openldap_update_modules_path.sh (bsc#1114845). - Create files in /var/lib/ldap/ during initial start to allow for transactional updates (bsc#1111388) - Fixed incorrect post script call causing tmpfiles creation not to be run (bsc#1111388).

References: https://www.suse.com/support/update/announcement/2019/suse-su-20192395-1/, https://bugzilla.suse.com/1073313, https://bugzilla.suse.com/1111388, https://bugzilla.suse.com/1114845, https://bugzilla.suse.com/1143194, https://bugzilla.suse.com/1143273, https://www.suse.com/security/cve/CVE-2017-17740, https://www.suse.com/security/cve/CVE-2019-13057, https://www.suse.com/security/cve/CVE-2019-13565