https://bugs.openldap.org/show_bug.cgi?id=9862
Issue ID: 9862 Summary: segmentation fault in ldap_simple_bind_s and openssl Product: OpenLDAP Version: 2.4.49 Hardware: x86_64 OS: Linux Status: UNCONFIRMED Keywords: needs_review Severity: normal Priority: --- Component: libraries Assignee: bugs@openldap.org Reporter: atsoi@marklogic.com Target Milestone: ---
We have segmentation fault when using ldap_simple_bind_s.
The openldap version is 2.4.59 The openssl version is 1.0.2zd.
2021-05-09 01:11:22.021 Critical:+#5 0x00007f8f7212a038 in signalHandler(int, siginfo_t, void) () from /usr/lib/jvm/jre-1.8.0-openjdk-1.8.0.282.b08-1.el7_9.x86_64/lib/amd64/server/libjvm.so 2021-05-09 01:11:22.021 Critical:+#6 2021-05-09 01:11:22.021 Critical:+#7 0x00007f8f78dc7f6e in BIO_set () from lib/libcrypto.so.1.0.0 2021-05-09 01:11:22.021 Critical:+#8 0x00007f8f78dc7fe2 in BIO_new () from lib/libcrypto.so.1.0.0 2021-05-09 01:11:22.021 Critical:+#9 0x00007f8f78a34574 in tlso_sb_setup () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#10 0x00007f8f787f6062 in ber_sockbuf_add_io () from lib/liblber-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#11 0x00007f8f78a31a68 in ldap_int_tls_connect.isra.1 () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#12 0x00007f8f78a32288 in ldap_int_tls_start () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#13 0x00007f8f78a0da70 in ldap_int_open_connection () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#14 0x00007f8f78a2014d in ldap_new_connection () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#15 0x00007f8f78a0d15a in ldap_open_defconn () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#16 0x00007f8f78a21568 in ldap_send_initial_request () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#17 0x00007f8f78a167a2 in ldap_sasl_bind () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#18 0x00007f8f78a16b8a in ldap_sasl_bind_s () from lib/libldap_r-2.4.so.2 2021-05-09 01:11:22.021 Critical:+#19 0x00007f8f78a172e0 in ldap_simple_bind_s () from lib/libldap_r-2.4.so.2
https://bugs.openldap.org/show_bug.cgi?id=9862
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|UNCONFIRMED |RESOLVED Resolution|--- |WONTFIX
--- Comment #1 from Quanah Gibson-Mount quanah@openldap.org --- Hello,
The OpenLDAP 2.4 series is historic and no longer supported. If you can reproduce the behavior using a supported release series, please feel free to re-open. I would note that OpenLDAP 2.5 and later do not support OpenSSL 1.0.2 series, only OpenSSL 1.1.1 and later.
In general, it's strongly advised to migrate to a current supported release series. There are a number of freely available options if pre-existing builds are required.
https://bugs.openldap.org/show_bug.cgi?id=9862
Quanah Gibson-Mount quanah@openldap.org changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|RESOLVED |VERIFIED Keywords|needs_review |
https://bugs.openldap.org/show_bug.cgi?id=9862
--- Comment #2 from atsoi@marklogic.com --- We need to support fips with openssl. But openssl 1.1.1 does not support fips so we cannot use that.
Openssl 3.0 will support fips. Which version of openldap support openssl 3.0?
Another question is how likely the seg fault will be fixed if we upgrade to openldap 2.5 or later?
Thanks
https://bugs.openldap.org/show_bug.cgi?id=9862
--- Comment #3 from Quanah Gibson-Mount quanah@openldap.org --- (In reply to atsoi from comment #2)
We need to support fips with openssl. But openssl 1.1.1 does not support fips so we cannot use that.
Openssl 3.0 will support fips. Which version of openldap support openssl 3.0?
OpenLDAP 2.6.2 and later support OpenSSL 3.0
Another question is how likely the seg fault will be fixed if we upgrade to openldap 2.5 or later?
OpenLDAP 2.5 and later do not support OpenSSL 1.0.2 series, so they would not be affected by any bugs present in OpenSSL 1.0.2zd.
If you can reproduce the segfault only after upgrading to OpenSSL 1.0.2zd, I would suggest filing a bug with the OpenSSL project for them to determine what they broke.
-
openldap-its＠openldap.org