MGASA-2021-0105 - Updated openldap packages fix security vulnerabilities

Publication date: 04 Mar 2021
URL: https://advisories.mageia.org/MGASA-2021-0105.html
Type: security
Affected Mageia releases: 7, 8
CVE: CVE-2020-36221,
     CVE-2020-36222,
     CVE-2020-36223,
     CVE-2020-36224,
     CVE-2020-36225,
     CVE-2020-36226,
     CVE-2020-36227,
     CVE-2020-36228,
     CVE-2020-36229,
     CVE-2020-36230,
     CVE-2021-27212

It was discovered that OpenLDAP incorrectly handled Certificate Exact
Assertion processing. A remote attacker could possibly use this issue to cause
OpenLDAP to crash, resulting in a denial of service (CVE-2020-36221).

It was discovered that OpenLDAP incorrectly handled saslAuthzTo processing. A
remote attacker could use this issue to cause OpenLDAP to crash, resulting in
a denial of service, or possibly execute arbitrary code (CVE-2020-36222,
CVE-2020-36224, CVE-2020-36225, CVE-2020-36226).

It was discovered that OpenLDAP incorrectly handled Return Filter control
handling. A remote attacker could use this issue to cause OpenLDAP to crash,
resulting in a denial of service, or possibly execute arbitrary code
(CVE-2020-36223).

It was discovered that OpenLDAP incorrectly handled certain cancel operations.
A remote attacker could possibly use this issue to cause OpenLDAP to crash,
resulting in a denial of service (CVE-2020-36227).

It was discovered that OpenLDAP incorrectly handled Certificate List Extract
Assertion processing. A remote attacker could possibly use this issue to cause
OpenLDAP to crash, resulting in a denial of service (CVE-2020-36228).

It was discovered that OpenLDAP incorrectly handled X.509 DN parsing. A remote
attacker could possibly use this issue to cause OpenLDAP to crash, resulting
in a denial of service (CVE-2020-36229, CVE-2020-36230).

Pasi Saarinen discovered that OpenLDAP incorrectly handled certain short
timestamps. A remote attacker could possibly use this issue to cause OpenLDAP
to crash, resulting in a denial of service (CVE-2021-27212).

References:
- https://bugs.mageia.org/show_bug.cgi?id=28300
- https://ubuntu.com/security/notices/USN-4724-1
- https://ubuntu.com/security/notices/USN-4744-1
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36221
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36222
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36223
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36224
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36225
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36226
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36227
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36228
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36229
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36230
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27212

SRPMS:
- 8/core/openldap-2.4.57-1.1.mga8
- 7/core/openldap-2.4.50-1.4.mga7