Amazon Linux 2 Security Advisory: ALAS2-2025-3058
Advisory Released Date: 2025-11-10
Advisory Updated Date: 2025-11-10
python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue. (CVE-2025-61912)
Affected Packages:
python-ldap
Note:
This advisory is applicable to Amazon Linux 2 (AL2) Core repository. Visit this FAQ section for the difference between AL2 Core and AL2 Extras advisories.
Issue Correction:
Run yum update python-ldap or yum update --advisory ALAS2-2025-3058 to update your system.
aarch64:
python-ldap-2.4.15-2.amzn2.0.6.aarch64
python-ldap-debuginfo-2.4.15-2.amzn2.0.6.aarch64
i686:
python-ldap-2.4.15-2.amzn2.0.6.i686
python-ldap-debuginfo-2.4.15-2.amzn2.0.6.i686
src:
python-ldap-2.4.15-2.amzn2.0.6.src
x86_64:
python-ldap-2.4.15-2.amzn2.0.6.x86_64
python-ldap-debuginfo-2.4.15-2.amzn2.0.6.x86_64