Skip to content

feat: update python-ldap to 3.4.4-1+deb13u1 #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
deepin-community-bot wants to merge 1 commit into
base: master
Choose a base branch
from
Open

feat: update python-ldap to 3.4.4-1+deb13u1 #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 4 additions & 11 deletions debian/changelog
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,16 +1,9 @@
python-ldap (3.4.4-1deepin2) unstable; urgency=medium
python-ldap (3.4.4-1+deb13u1) trixie; urgency=medium

* Fix CVE-2025-61912: correctly escape null bytes in escape_dn_chars
according to RFC 4514 to prevent client-side denial of service.
* CVE-2025-61911 (Closes: #1117858)
* CVE-2025-61912 (Closes: #1117859)

-- deepin-ci-robot <packages@deepin.org> Thu, 07 May 2026 20:02:44 +0800

python-ldap (3.4.4-1deepin1) unstable; urgency=medium

* Fix CVE-2025-61911: enforce str type for escape_filter_chars to
prevent LDAP injection attacks via crafted list/dict objects.

-- deepin-ci-robot <packages@deepin.org> Thu, 07 May 2026 19:58:16 +0800
-- Moritz Mühlenhoff <jmm@debian.org> Mon, 06 Apr 2026 23:33:25 +0200

python-ldap (3.4.4-1) unstable; urgency=low

Expand Down
24 changes: 12 additions & 12 deletions debian/patches/0003-CVE-2025-61911.patch → debian/patches/CVE-2025-61911.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,10 @@
Index: github-python-ldap-scout/Lib/ldap/filter.py
===================================================================
--- github-python-ldap-scout.orig/Lib/ldap/filter.py
+++ github-python-ldap-scout/Lib/ldap/filter.py
From 464fddacd63092d6e01c62a38316a713c30ca98a Mon Sep 17 00:00:00 2001
From: lukas-eu <62448426+lukas-eu@users.noreply.github.com>
Date: Fri, 10 Oct 2025 19:47:46 +0200
Subject: [PATCH] Merge commit from fork

--- python-ldap-3.4.4.orig/Lib/ldap/filter.py
+++ python-ldap-3.4.4/Lib/ldap/filter.py
@@ -24,6 +24,8 @@ def escape_filter_chars(assertion_value,
If 1 all NON-ASCII chars are escaped.
If 2 all chars are escaped.
Expand All @@ -11,19 +14,16 @@ Index: github-python-ldap-scout/Lib/ldap/filter.py
if escape_mode:
r = []
if escape_mode==1:
Index: github-python-ldap-scout/Tests/t_ldap_filter.py
===================================================================
--- github-python-ldap-scout.orig/Tests/t_ldap_filter.py
+++ github-python-ldap-scout/Tests/t_ldap_filter.py
@@ -50,6 +50,11 @@ class TestDN(unittest.TestCase):
--- python-ldap-3.4.4.orig/Tests/t_ldap_filter.py
+++ python-ldap-3.4.4/Tests/t_ldap_filter.py
@@ -49,6 +49,10 @@ class TestDN(unittest.TestCase):
),
r'\c3\a4\c3\b6\c3\bc\c3\84\c3\96\c3\9c\c3\9f'
)

+ with self.assertRaises(TypeError):
+ escape_filter_chars(["abc@*()/xyz"], escape_mode=1)
+ with self.assertRaises(TypeError):
+ escape_filter_chars({"abc@*()/xyz": 1}, escape_mode=1)
+
def test_escape_filter_chars_mode2(self):
"""
test function escape_filter_chars() with escape_mode=2
21 changes: 11 additions & 10 deletions debian/patches/0004-CVE-2025-61912.patch → debian/patches/CVE-2025-61912.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,27 +1,28 @@
Index: github-python-ldap-scout/Lib/ldap/dn.py
===================================================================
--- github-python-ldap-scout.orig/Lib/ldap/dn.py
+++ github-python-ldap-scout/Lib/ldap/dn.py
From 9f5b2effbafdf7af0e7064a7aa42d2739d373bd7 Mon Sep 17 00:00:00 2001
From: Simon Pichugin <simon.pichugin@gmail.com>
Date: Fri, 10 Oct 2025 10:46:45 -0700
Subject: [PATCH] Merge commit from fork

--- python-ldap-3.4.4.orig/Lib/ldap/dn.py
+++ python-ldap-3.4.4/Lib/ldap/dn.py
@@ -26,7 +26,8 @@ def escape_dn_chars(s):
s = s.replace('>' ,'\\>')
s = s.replace(';' ,'\\;')
s = s.replace('=' ,'\\=')
- s = s.replace('\000' ,'\\\000')
+ # RFC 4514 requires NULL (U+0000) to be escaped as hex pair "\\00"
+ # RFC 4514 requires NULL (U+0000) to be escaped as hex pair "\00"
+ s = s.replace('\x00' ,'\\00')
if s[-1]==' ':
s = ''.join((s[:-1],'\\ '))
if s[0]=='#' or s[0]==' ':
Index: github-python-ldap-scout/Tests/t_ldap_dn.py
===================================================================
--- github-python-ldap-scout.orig/Tests/t_ldap_dn.py
+++ github-python-ldap-scout/Tests/t_ldap_dn.py
--- python-ldap-3.4.4.orig/Tests/t_ldap_dn.py
+++ python-ldap-3.4.4/Tests/t_ldap_dn.py
@@ -49,7 +49,7 @@ class TestDN(unittest.TestCase):
self.assertEqual(ldap.dn.escape_dn_chars(' '), '\\ ')
self.assertEqual(ldap.dn.escape_dn_chars(' '), '\\ \\ ')
self.assertEqual(ldap.dn.escape_dn_chars('foobar '), 'foobar\\ ')
- self.assertEqual(ldap.dn.escape_dn_chars('f+o>o,b<a;r="\00"'), 'f\\+o\\>o\\,b\\<a\\;r\\=\\"\\\x00\\"')
+ self.assertEqual(ldap.dn.escape_dn_chars('f+o>o,b<a;r="\00"'), r'f\+o\>o\,b\<a\;r\=\"\00\"')
+ self.assertEqual(ldap.dn.escape_dn_chars('f+o>o,b<a;r="\00"'), 'f\\+o\\>o\\,b\\<a\\;r\\=\\"\\00\\"')
self.assertEqual(ldap.dn.escape_dn_chars('foo\\,bar'), 'foo\\\\\\,bar')

def test_str2dn(self):
4 changes: 2 additions & 2 deletions debian/patches/series
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
0001-Search-for-slapadd-in-sbin-path.patch
0002-Use-local-objects.inv-in-intersphinx-mapping.patch
0003-CVE-2025-61911.patch
0004-CVE-2025-61912.patch
CVE-2025-61911.patch
CVE-2025-61912.patch
Loading