Multiple Denial of Service vulnerabilities have been reported in OpenLDAP.
|Package||net-nds/openldap on all architectures|
|Affected versions||< 2.3.41|
|Unaffected versions||>= 2.3.41|
OpenLDAP Software is an open source implementation of the Lightweight Directory Access Protocol.
The following errors have been discovered in OpenLDAP:
A remote attacker can cause a Denial of Serivce by sending a malformed "objectClasses" attribute, and via unknown vectors that prevent the "new_attrs" array from being NULL terminated, and via a modrdn operation with a NOOP (LDAP_X_NO_OPERATION) control.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.3.41"