Multiple vulnerabilities were found in OpenLDAP, allowing for Denial of Service or a man-in-the-middle attack.
|Package||net-nds/openldap on all architectures|
|Affected versions||< 2.4.35|
|Unaffected versions||>= 2.4.35|
OpenLDAP is an LDAP suite of application and development tools.
Multiple vulnerabilities have been discovered in OpenLDAP. Please review the CVE identifiers referenced below for details.
A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections made using OpenLDAP, bypass security restrictions or cause a Denial of Service condition.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.4.35"