PT-2018-11784 · Apache · Apache Directory Ldap Api

Publicado 2018-07-10 · Atualizado 2020-08-24 · CVE-2018-1337

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions prior to 1.0.2

Description A bug in the setup of the SSL Filter allows another thread to use a connection before the TLS layer is established, potentially leaking information, including credentials sent in a BIND request.

Recommendations For versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider disabling connection pooling to minimize the risk of exploitation. Restrict access to sensitive operations, such as BIND requests, until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2018-1337

GHSA-CFW5-V7CW-69CW

Produtos afetados

Apache Directory Ldap Api

Referências · 21

• https://lists.apache.org/thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749%40%3Cjira.kafka.apache.org%3E · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-1337 · Nota de Segurança
• https://lists.apache.org/thread.html/r55e74532e7f9e84ecfa56b4e0a50a5fe0ba6f7a76880520e4400b0d7@%3Cjira.kafka.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749@%3Cjira.kafka.apache.org%3E · Nota
• http://securityfocus.com/bid/104744 · Nota
• https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f%40%3Cdev.directory.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b@%3Cdev.kafka.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r4da40aa50cfdb2158898f2bc6df81feec1d42c6a06db6537d5cc0496%40%3Cjira.kafka.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616%40%3Cjira.kafka.apache.org%3E · Nota
• https://security-tracker.debian.org/tracker/CVE-2018-1337 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2018-1337 · Aviso do Fabricante
• https://lists.apache.org/thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446%40%3Cdev.kafka.apache.org%3E · Nota
• https://lists.apache.org/thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b%40%3Cdev.kafka.apache.org%3E · Nota
• https://osv.dev/vulnerability/GHSA-cfw5-v7cw-69cw · Aviso do Fabricante
• https://lists.apache.org/thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446@%3Cdev.kafka.apache.org%3E · Nota