Issued:

2014-06-09

Updated:

2014-10-13

RHBA-2014:0641 - perl-Authen-SASL bug fix update

Synopsis

perl-Authen-SASL bug fix update

Type/Severity

Bug Fix Advisory

Topic

An updated perl-Authen-SASL package that fixes one bug is now available for Red Hat Enterprise Linux 6.

Description

Simple Authentication and Security Layer (SASL) is a generic mechanism for authentication used by several network protocols. The Authen::SASL module provides an implementation framework that all protocols should be able to share.

This update fixes the following bug:

• Due to a bug in the Authen::SASL Perl module, the substr() function attempted to read data outside of the appropriate string. As a consequence, when the user was authenticated against an LDAP server over SASL, performing logical operations, such as search, with a Perl program on that server failed. With this update, the Authen::SASL module verifies the length of the string that is encrypted and written to a filehandle. As a result, performing a search returns correct results in the described situation. (BZ#965739)

Users of perl-Authen-SASL are advised to upgrade to this updated package, which fixes this bug.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/site/articles/11258

Affected Products

Updated Packages

• perl-Authen-SASL-2.13-3.el6.noarch.rpm
• perl-Authen-SASL-2.13-3.el6.src.rpm

Fixes

(none)

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.