Re: [PATCH 0/1] Update OpenLDAP, fixing CVE-2015-6908

[Leo Famulari <leo@famulari.name>]

[-- Attachment #1: Type: text/plain, Size: 489 bytes --]

On Fri, Apr 22, 2016 at 11:28:20PM -0400, Mark H Weaver wrote:
> Leo Famulari <leo@famulari.name> writes:
> > There is a remote denial of service bug in OpenLDAP in version 2.4.42
> > and earlier [0].
> 
> I think we'll need to graft this.  Would you like to try grafting it on
> your own system, see if anything obvious breaks, and then report back?

My last patch was, to be nice, incomplete. Here is an updated version.

I've tried to replicate the examples in caeadfddb and d8173f21f.

[-- Attachment #2: 0001-gnu-openldap-Update-to-2.4.44-fixes-CVE-2015-6908.patch --]
[-- Type: text/x-diff, Size: 2008 bytes --]

From 267f0cf5e5f062484780b8e0c9d246a56b9a3a35 Mon Sep 17 00:00:00 2001
From: Leo Famulari <leo@famulari.name>
Date: Thu, 21 Apr 2016 12:49:48 -0400
Subject: [PATCH] gnu: openldap: Update to 2.4.44 [fixes CVE-2015-6908].

* gnu/packages/openldap.scm (openldap)[replacement]: New field.
(openldap-fixed): New variable.
---
 gnu/packages/openldap.scm | 23 +++++++++++++++++++++++
 1 file changed, 23 insertions(+)

diff --git a/gnu/packages/openldap.scm b/gnu/packages/openldap.scm
index d416a43..429078f 100644
--- a/gnu/packages/openldap.scm
+++ b/gnu/packages/openldap.scm
@@ -1,6 +1,7 @@
 ;;; GNU Guix --- Functional package management for GNU
 ;;; Copyright © 2013, 2014, 2015 Ludovic Courtès <ludo@gnu.org>
 ;;; Copyright © 2013 Andreas Enge <andreas@enge.fr>
+;;; Copyright © 2016 Leo Famulari <leo@famulari.name>
 ;;;
 ;;; This file is part of GNU Guix.
 ;;;
@@ -33,6 +34,7 @@
 
 (define-public openldap
   (package
+   (replacement openldap-2.4.44)
    (name "openldap")
    (version "2.4.42")
    (source (origin
@@ -76,3 +78,24 @@
     "OpenLDAP is a free implementation of the Lightweight Directory Access Protocol.")
    (license openldap2.8)
    (home-page "http://www.openldap.org/")))
+
+(define openldap-2.4.44
+  (package
+    (inherit openldap)
+    (replacement #f)
+    (source
+      (let ((version "2.4.44"))
+        (origin
+          (method url-fetch)
+          (uri (list (string-append
+                      "ftp://mirror.switch.ch/mirror/OpenLDAP/"
+                      "openldap-release/openldap-" version ".tgz")
+                     (string-append
+                      "ftp://ftp.OpenLDAP.org/pub/OpenLDAP/"
+                      "openldap-release/openldap-" version ".tgz")
+                     (string-append
+                      "ftp://ftp.dti.ad.jp/pub/net/OpenLDAP/"
+                      "openldap-release/openldap-" version ".tgz")))
+          (sha256
+           (base32
+            "0044p20hx07fwgw2mbwj1fkx04615hhs1qyx4mawj2bhqvrnppnp")))))))
-- 
2.7.4