python-ldap-dev

ANN: python-ldap-2.0.0pre06

[<mi...@st...>]

HI!

Find a new pre-release of python-ldap:

   http://python-ldap.sourceforge.net/

python-ldap provides an object-oriented API to access LDAP directory 
servers from Python programs. It mainly wraps the OpenLDAP 2.x libs for 
that purpose. Additionally it contains modules for other LDAP-related 
stuff (e.g. processing LDIF, LDAPURLs and LDAPv3 schema).

Download link:
http://prdownloads.sourceforge.net/python-ldap/python-ldap-2.0.0pre06.tar.gz?download

Changes since 2.0.0pre05:
- Fine-grained locking when linking against libldap_r
- New wrapper class ldap.ReconnectLDAPObject
- Security fix to module ldapurl
- Other fixes and improvements to whole package
- LDAPv3 schema support (still somewhat premature and undocumented)

Ciao, Michael.

Re: ANN: python-ldap-2.0.0pre06

[Peter H. <pe...@ha...>]

Hi...
On Wed, 25 Sep 2002 01:55 am, Michael Str=F6der wrote:
> HI!
>
> Find a new pre-release of python-ldap:
> ...
> - Security fix to module ldapurl

Can you explain this more clearly? How severe is it? Which versions=20
does it affect? Do I need to issue an advisory against my package?

> ...

Also, pre06 doesn't appear to build against ldap_r (functions like=20
ldap_first_reference don't exist in ldap_r).

=3D)
Peter

--=20
pe...@ha...
GPG key fingerprint:
C746 38A9 D3E4 A171 FB6A  56D4 5E30 DFCC BE11 F437

Security fix module ldapurl (was: ANN: python-ldap-2.0.0pre06)

[<mi...@st...>]

Peter Hawkins wrote:
>>- Security fix to module ldapurl
> 
> Can you explain this more clearly? How severe is it?

If an application used the LDAP URL extensions bindname and X-BINDPW in 
prior versions the key-word arg 'extensions' for LDAPUrl._init__() was 
not newly initialized each time. This could in some cases reveal login 
information elsewhere through LDAP URLs generated with this module.

See also:
http://www.geocrawler.com/lists/3/SourceForge/1568/0/9527098/

The follow-ups:
http://www.geocrawler.com/lists/3/SourceForge/1568/0/9527860/
http://www.geocrawler.com/lists/3/SourceForge/1568/0/9527887/
http://www.geocrawler.com/lists/3/SourceForge/1568/0/9533130/

 > Which versions does it affect?

2.0.0pre05 and prior versions which contain module ldapurl.

 > Do I need to issue an advisory against my package?

Depends on your policy.

Ciao, Michael.