[Secure-testing-team] Bug#791957: apache-directory-api: CVE-2015-3250

[Salvatore Bonaccorso]

Source: apache-directory-api
Version: 1.0.0~M20-1
Severity: important
Tags: security upstream fixed-upstream

Hi Emmanuel,

the following vulnerability was published for apache-directory-api,
filling a bug in the BTS to have it documented. AFAICS no much
information but it is fixed in new upstream version 1.0.0~M31. Could
you update the package to it?

CVE-2015-3250[0]:
timing attack vulnerability

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2015-3250
[1] http://www.openwall.com/lists/oss-security/2015/07/07/5 (note
    there was a typo in the CVE referenced there)

Regards,
Salvatore