Bug 1238322 (CVE-2015-3276)
| Summary: | CVE-2015-3276 openldap: incorrect multi-keyword mode cipherstring parsing | ||||||
|---|---|---|---|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | Vasyl Kaigorodov <vkaigoro> | ||||
| Component: | vulnerability | Assignee: | Red Hat Product Security <security-response-team> | ||||
| Status: | CLOSED ERRATA | QA Contact: | |||||
| Severity: | medium | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | unspecified | CC: | ankur.sao7, ebenes, he, jpazdziora, jrusnack, jsynacek, mhonek, mpoole, pkis, pmatouse, sardella, security-response-team, slawomir, vkaigoro | ||||
| Target Milestone: | --- | Keywords: | Reopened, Security | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | Doc Type: | Bug Fix | |||||
| Doc Text: |
A flaw was found in the way OpenLDAP parsed OpenSSL-style cipher strings. As a result, OpenLDAP could potentially use ciphers that were not intended to be enabled.
|
Story Points: | --- | ||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2015-11-20 05:21:31 UTC | Type: | --- | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | 1231522, 1243517 | ||||||
| Bug Blocks: | 1210268, 1238327 | ||||||
| Attachments: |
|
||||||
|
Description
Vasyl Kaigorodov
2015-07-01 15:20:52 UTC
Created openldap tracking bugs for this issue: Affects: fedora-all [bug 1243517] Created attachment 1055640 [details]
patch against current upstream to provide correct AND logic for multiple-mask keywords
Statement: This issue does not affect the version of openldap package as shipped with Red Hat Enterprise Linux 5. This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Via RHSA-2015:2131 https://rhn.redhat.com/errata/RHSA-2015-2131.html Which version of openLdap is affected by this vulnerability and in which version it is fixed ? (In reply to Ankur Sao from comment #9) > Which version of openLdap is affected by this vulnerability and in which > version it is fixed ? By the looks of it, all versions of openLdap are affected; I know the latest at 2.4.44 is. I tried submitting this bug upstream, but got turned away because of IPR concerns over the rights to the fix, ref. http://www.openldap.org/its/index.cgi?findid=8543 Can someone from RedHat please submit this bugfix to LDAP, because that doesn't appear to have happened... Best regards, - Håvard Hello, while doing review of the Vulnerability Assessment report of RHEL 8.6 for the purpose of Common Criteria certification, we came across this CVE-2015-3276. The CVE page https://access.redhat.com/security/cve/CVE-2015-3276 does not even list RHEL 8. However, the comment 10 above mentions that the fix was rejected upstream. Do we still carry the patch downstream in RHEL 8 (RHEL 8.6 has openldap-2.4.46-16.el8)? Could the CVE page be updated with Red Hat's official statement about this CVE in RHEL 8? Thank you, Jan This CVE is not applicable to RHEL8 (and later). openldap package went back to using openssl for cryptographic purposes rather than the compatibility shim on top of nss that had the issue. Great, thanks for the confirmation. In reply to comment #11: > Could the CVE page be updated with Red Hat's official statement about this CVE in RHEL 8? added statement Thanks but ... I was more after the short note of why we believe it to be so, similar to Martin's comment 12? It would help us in communication with the external parties. |