Skip to content
OpenAdvisories
Medium ALAS2-2025-3058 1 CVE

Moderate: python-ldap security update (Amazon Linux 2)

Published Nov 10, 2025 · Updated Nov 10, 2025

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2025-61912: python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2 python-ldap 0:2.4.15-2.amzn2.0.6
Amazon Linux · 2 python-ldap-debuginfo 0:2.4.15-2.amzn2.0.6

Vulnerabilities 1

  • Medium 5.5
    CVE-2025-61912

    python-ldap Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination

    python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. An…

    python-ldap python-ldap python-ldap python-ldap Debian Ubuntu Azure Linux Alpine PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2025-61912.html