Overview
Request 718338 superseded
- Update to upstream release 2.4.48 with security fixes:
* CVE-2019-13057 (ITS#9038):
rootdn of any db can assert any identity
* CVE-2019-13565 (ITS#9052):
ACL protections get lost if same identity uses different SSF levels
- Fix CVE-2017-17740 by disabling nops overlay not maintained by upstream
(see also bsc#1073313, comment #36)
- Removed obsolete patches:
* 0002-openldap-its8727-plug-ber-leaks.patch
* 0017-Fix-segfault-in-nops.patch
- Created by stroeder
- In state superseded
- Package maintainers: jengelh and jmcdough
- Superseded by 718342
Request History
stroeder created request
- Update to upstream release 2.4.48 with security fixes:
* CVE-2019-13057 (ITS#9038):
rootdn of any db can assert any identity
* CVE-2019-13565 (ITS#9052):
ACL protections get lost if same identity uses different SSF levels
- Fix CVE-2017-17740 by disabling nops overlay not maintained by upstream
(see also bsc#1073313, comment #36)
- Removed obsolete patches:
* 0002-openldap-its8727-plug-ber-leaks.patch
* 0017-Fix-segfault-in-nops.patch
Note that I disabled slapo-nops instead of rebasing 0017-Fix-segfault-in-nops.patch which is somewhat debatable. You can take it or leave it.