Security
Security
Multiple vulnerabilities were found in OpenLDAP, allowing for Denial of Service or a man-in-the-middle attack.
| Package | net-nds/openldap on all architectures |
|---|---|
| Affected versions | < 2.4.35 |
| Unaffected versions | >= 2.4.35 |
OpenLDAP is an LDAP suite of application and development tools.
Multiple vulnerabilities have been discovered in OpenLDAP. Please review the CVE identifiers referenced below for details.
A remote attacker might employ a specially crafted certificate to conduct man-in-the-middle attacks on SSL connections made using OpenLDAP, bypass security restrictions or cause a Denial of Service condition.
There is no known workaround at this time.
All OpenLDAP users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=net-nds/openldap-2.4.35"