- Update to 3.4.5

* Security fixes:
    + CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce str input in
      ldap.filter.escape_filter_chars with escape_mode=1; ensure proper
      escaping. (bsc#1251912)
    + CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in
      ldap.dn.escape_dn_chars to \00 per RFC 4514. (bsc#1251913)
  * Fixes:
    + ReconnectLDAPObject now properly reconnects on UNAVAILABLE,
      CONNECT_ERROR and TIMEOUT exceptions (previously only SERVER_DOWN),
      fixing reconnection issues especially during server restarts
    + Fixed syncrepl.py to use named constants instead of raw decimal values
      for result types
    + Fixed error handling in SearchNoOpMixIn to prevent a undefined variable
      error
- Switch to building with pip, wheel and the pyproject macros.
- Fix filename due to new setuptools.

0001-Use-reentrant-libldap.patch

@@ -0,0 +1,25 @@
+From de85e6b833fc43f273f688680d7a95e9a8330704 Mon Sep 17 00:00:00 2001
+From: William Brown <william@blackhats.net.au>
+Date: Tue, 5 Aug 2025 15:24:49 +1000
+Subject: [PATCH] Use reentrant libldap
+
+---
+ Build/setup.cfg.suse-linux | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/Build/setup.cfg.suse-linux b/Build/setup.cfg.suse-linux
+index 0a48ef2..d715737 100644
+--- a/Build/setup.cfg.suse-linux
++++ b/Build/setup.cfg.suse-linux
+@@ -15,7 +15,7 @@ extra_objects =
+ # Support for StartTLS/LDAPS, SASL bind and reentrant libldap_r.
+ # This needs recent OpenLDAP 2.0.26+ or 2.1.3+ built with
+ # ./configure --with-cyrus-sasl --with-tls
+-libs = ldap_r lber sasl2 ssl crypto
++libs = ldap lber sasl2 ssl crypto
+ 
+ [install]
+ # Installation options
+-- 
+2.39.5 (Apple Git-154)
+

python-ldap.changes

@@ -1,3 +1,35 @@
+-------------------------------------------------------------------
+Fri Oct 24 03:09:41 UTC 2025 - Steve Kowalik <steven.kowalik@suse.com>
+
+- Update to 3.4.5:
+  * Security fixes:
+    + CVE-2025-61911 (GHSA-r7r6-cc7p-4v5m): Enforce str input in
+      ldap.filter.escape_filter_chars with escape_mode=1; ensure proper
+      escaping. (bsc#1251912)
+    + CVE-2025-61912 (GHSA-p34h-wq7j-h5v6): Correct NUL escaping in
+      ldap.dn.escape_dn_chars to \00 per RFC 4514. (bsc#1251913)
+  * Fixes:
+    + ReconnectLDAPObject now properly reconnects on UNAVAILABLE,
+      CONNECT_ERROR and TIMEOUT exceptions (previously only SERVER_DOWN),
+      fixing reconnection issues especially during server restarts
+    + Fixed syncrepl.py to use named constants instead of raw decimal values
+      for result types
+    + Fixed error handling in SearchNoOpMixIn to prevent a undefined variable
+      error
+- Switch to building with pip, wheel and the pyproject macros.
+- Fix filename due to new setuptools.
+
+-------------------------------------------------------------------
+Tue Aug  5 05:27:36 UTC 2025 - William Brown <william.brown@suse.com>
+
+- Allow building against OpenLDAP 2.5
+  * 0001-Use-reentrant-libldap.patch
+
+-------------------------------------------------------------------
+Thu Aug 29 07:22:28 UTC 2024 - Markéta Machová <mmachova@suse.com>
+
+- Enable sle15_python_module_pythons (boo#1229549)
+
 -------------------------------------------------------------------
 Thu Dec 14 21:14:57 UTC 2023 - Dirk Müller <dmueller@suse.com>
 

python-ldap.spec

@@ -1,7 +1,7 @@
 #
 # spec file for package python-ldap
 #
-# Copyright (c) 2023 SUSE LLC
+# Copyright (c) 2024 SUSE LLC
 #
 # All modifications and additions to the file contributed by third parties
 # remain the property of their copyright owners, unless otherwise agreed
@@ -16,22 +16,22 @@
 #
 
 
-%{?!python_module:%define python_module() python-%{**} python3-%{**}}
-
-%define skip_python2 1
-
+%{?sle15_python_module_pythons}
 Name:           python-ldap
-Version:        3.4.4
+Version:        3.4.5
 Release:        0
 Summary:        Python LDAP interface
 License:        Python-2.0
 Group:          Development/Libraries/Python
 URL:            https://www.python-ldap.org/
-Source0:        https://files.pythonhosted.org/packages/source/p/python-ldap/python-ldap-%{version}.tar.gz
+Source0:        https://files.pythonhosted.org/packages/source/p/python-ldap/python_ldap-%{version}.tar.gz
+Patch0:         0001-Use-reentrant-libldap.patch
 BuildRequires:  %{python_module devel}
+BuildRequires:  %{python_module pip}
 BuildRequires:  %{python_module pyasn1 >= 0.3.7}
 BuildRequires:  %{python_module pyasn1-modules >= 0.1.5}
 BuildRequires:  %{python_module setuptools}
+BuildRequires:  %{python_module wheel}
 BuildRequires:  cyrus-sasl-devel >= 2.1
 BuildRequires:  fdupes
 BuildRequires:  krb5-devel
@@ -53,14 +53,14 @@ for that purpose.  Additionally the package contains modules for other
 LDAP-related stuff (e.g. processing LDIF, LDAPURLs, LDAPv3 schema, etc.).
 
 %prep
-%setup -q
+%autosetup -p1 -n python_ldap-%{version}
 cp Build/setup.cfg.suse-linux setup.cfg
 
 %build
-CFLAGS="%{optflags}" %python_build
+CFLAGS="%{optflags}" %pyproject_wheel
 
 %install
-%python_install
+%pyproject_install
 %python_expand %fdupes %{buildroot}%{$python_sitearch}
 
 %check
@@ -69,6 +69,13 @@ PATH=/sbin:/usr/sbin:/usr/local/bin:/usr/bin:/bin %pyunittest_arch discover -v -
 %files %{python_files}
 %license LICENCE
 %doc README Demo CHANGES TODO
-%{python_sitearch}/*
+%{python_sitearch}/ldap
+%{python_sitearch}/python_ldap-%{version}.dist-info
+%{python_sitearch}/slapdtest
+%{python_sitearch}/ldapurl.py
+%{python_sitearch}/ldif.py
+%{python_sitearch}/_ldap*
+%pycache_only %{python_sitearch}/__pycache__/ldapurl*
+%pycache_only %{python_sitearch}/__pycache__/ldif*
 
 %changelog