python3-ldap: python-ldap is a lightweight directory access protocol (LDAP) client APIfor Python

python-ldap is a lightweight directory access protocol (LDAP) client APIfor Python. In versions prior to 3.4.5, the sanitization method`ldap.filter.escape_filter_chars` can be tricked to skip escaping ofspecial characters when a crafted `list` or `dict` is supplied as the`assertion_value` parameter, and the non-default `escape_mode=1` isconfigured. The method `ldap.filter.escape_filter_chars` supports 3different escaping modes. `escape_mode=0` (default) and `escape_mode=2`happen to raise exceptions when a `list` or `dict` object is supplied asthe `assertion_value` parameter. However, `escape_mode=1` computes withoutperforming adequate logic to ensure a fully escaped return value. If anapplication relies on the vulnerable method in the `python-ldap` library toescape untrusted user input, an attacker might be able to abuse thevulnerability to launch ldap injection attacks which could potentiallydisclose or manipulate ldap data meant to be inaccessible to them. Version3.4.5 fixes the issue by adding a type check at the start of the`ldap.filter.escape_filter_chars` method to raise an exception when thesupplied `assertion_value` parameter is not of type `str`.

Where it's fixed