SB2017112207 - Debian update for libspring-ldap-java
Published: November 22, 2017
Security Bulletin ID
SB2017112207
Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Remote access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 security vulnerability.
1) Authentication bypass (CVE-ID: CVE-2017-8028)
The vulnerability allows a remote attacker to bypass authentication on the target system.The weakness exists due to some LDAP vendors require an explicit operation for the LDAP bind to take effect. A remote attacker with knowledge of the username can authenticate with an arbitrary password when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch.
Remediation
Install update from vendor's website.