[ GLSA 201406-36 ] OpenLDAP: Multiple vulnerabilities

[GLSA]

Gentoo Linux Security Advisory

Title: OpenLDAP: Multiple vulnerabilities (GLSA 201406-36)
Severity: normal
Exploitable: remote
Date: June 30, 2014
Bug(s): #290345, #323777, #355333, #388605, #407941, #424167
ID: 201406-36

Synopsis

Multiple vulnerabilities were found in OpenLDAP, allowing for
Denial of Service or a man-in-the-middle attack.


Background

OpenLDAP is an LDAP suite of application and development tools.

Affected Packages

Package: net-nds/openldap
Vulnerable: < 2.4.35
Unaffected: >= 2.4.35
Architectures: All supported architectures


Description

Multiple vulnerabilities have been discovered in OpenLDAP. Please review
the CVE identifiers referenced below for details.


Impact

A remote attacker might employ a specially crafted certificate to
conduct man-in-the-middle attacks on SSL connections made using OpenLDAP,
bypass security restrictions or cause a Denial of Service condition.


Workaround

There is no known workaround at this time.

Resolution

All OpenLDAP users should upgrade to the latest version: