Mageia alert MGASA-2015-0181 (cherokee)

From:
    	     
 
Mageia Updates <buildsystem-daemon@mageia.org> 
To:
    	     
 
updates-announce@ml.mageia.org 
Subject:
    	     
 
[updates-announce] MGASA-2015-0181: Updated cherokee packages fix CVE-2014-4668 
Date:
    	     
 
Sun, 3 May 2015 02:19:46 +0200
Message-ID:
    	     
 
<20150503001946.AA7F44193B@valstar.mageia.org>
MGASA-2015-0181 - Updated cherokee packages fix CVE-2014-4668

Publication date: 03 May 2015
URL: http://advisories.mageia.org/MGASA-2015-0181.html
Type: security
Affected Mageia releases: 4
CVE: CVE-2014-4668

Description:
Updated cherokee packages fix security vulnerability:

The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee
 1.2.103 and earlier, when LDAP is used, does not properly consider
unauthenticated-bind semantics, which allows remote attackers to bypass
authentication via an empty password (CVE-2014-4668).

References:
- https://bugs.mageia.org/show_bug.cgi?id=15755
- https://lists.fedoraproject.org/pipermail/package-announc...
- http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4668

SRPMS:
- 4/core/cherokee-1.2.103-2.2.mga4