An update of the openldap package has been released.

An update for openldap is now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

OpenLDAP is an open source suite of Lightweight Directory Access Protocol (LDAP) applications and development tools. LDAP is a set of protocols used to access and maintain distributed directory information services over an IP network. The openldap packages contain configuration files, libraries, and documentation for OpenLDAP.

The following packages have been upgraded to a later upstream version:
openldap (2.4.44). (BZ#1386365)

Security Fix(es) :

* A double-free flaw was found in the way OpenLDAP's slapd server using the MDB backend handled LDAP searches. A remote attacker with access to search the directory could potentially use this flaw to crash slapd by issuing a specially crafted LDAP search query.
(CVE-2017-9287)

Additional Changes :

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Karsten Heymann discovered that the OpenLDAP directory server can be crashed by performing a paged search with a page size of 0, resulting in denial of service. This vulnerability is limited to the MDB storage backend.

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3307-1 advisory.

    Karsten Heymann discovered that OpenLDAP incorrectly handled certain search requests. A remote attacker     could use this issue to cause slapd to crash, resulting in a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Security fix for CVE-2017-9287

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The following packages have been upgraded to a later upstream version:
openldap (2.4.44).

Security Fix(es) :

  - A double-free flaw was found in the way OpenLDAP's slapd     server using the MDB backend handled LDAP searches. A     remote attacker with access to search the directory     could potentially use this flaw to crash slapd by     issuing a specially crafted LDAP search query.
    (CVE-2017-9287)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - servers/slapd/back-mdb/search.c in OpenLDAP through 2.4.44 is prone to a double free vulnerability. A user     with access to search the directory can crash slapd by issuing a search including the Paged Results     control with a page size of 0. (CVE-2017-9287)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
121713	Photon OS 1.0: Openldap PHSA-2017-0024	Nessus	PhotonOS Local Security Checks	2019/2/7	2024/7/22	medium
102735	CentOS 7 : openldap (CESA-2017:1852)	Nessus	CentOS Local Security Checks	2017/8/25	2025/11/25	medium
100522	Debian DSA-3868-1 : openldap - security update	Nessus	Debian Local Security Checks	2017/5/31	2025/12/17	medium
100591	Ubuntu 14.04 LTS / 16.04 LTS : OpenLDAP vulnerability (USN-3307-1)	Nessus	Ubuntu Local Security Checks	2017/6/2	2024/8/27	medium
101795	Fedora 25 : openldap (2017-1ca18683e4)	Nessus	Fedora Local Security Checks	2017/7/19	2025/12/10	medium
102649	Scientific Linux Security Update : openldap on SL7.x x86_64 (20170801)	Nessus	Scientific Linux Local Security Checks	2017/8/22	2025/11/26	medium
221760	Linux Distros Unpatched Vulnerability : CVE-2017-9287	Nessus	Misc.	2025/3/4	2026/7/24	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium