openldap-2.4.23-26.AXS4.2

OpenLDAP is an open source suite of LDAP (Lightweight Directory Access Protocol) applications and development tools. LDAP is a set of protocols for accessing directory services (usually phone book style information, but other information is possible) over the Internet, similar to the way DNS (Domain Name System) information is propagated over the Internet. The openldap package contains configuration files, libraries, and documentation for OpenLDAP.

Security issues fixed with this release:

• CVE-2012-2668
libraries/libldap/tls_m.c in OpenLDAP, possibly 2.4.31 and earlier, when using the Mozilla NSS backend, always uses the default cipher suite even when TLSCipherSuite is set, which might cause OpenLDAP to use weaker ciphers than intended and make it easier for remote attackers to obtain sensitive information.

Fixed bug:

• Previously, on smbk5pwd overlay enabled OpenLDAP servers, if a user changed their password, the Microsoft NT LAN Manager (NTLM) and Microsoft LAN Manager (LM) hashes were not computed correctly, leading to the sambaLMPassword and sambaNTPassword attributes being updated with incorrect values and the user not being able to log in from a Samba or a Windows-based client. This has been fixed: the smbk5pwd overlay is now linked against OpenSSL.