PT-2017-4053 · Pivotal · Spring Ldap

Published 2017-11-22 · Updated 2022-05-13 · CVE-2017-8028

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Pivotal Spring-LDAP versions 1.3.0 through 2.3.1

Description The issue is related to authentication errors in the LDAP module of the Spring Security Java framework. When connected to certain LDAP servers and using the LDAP BindAuthenticator with the org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, authentication is allowed with an arbitrary password if the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

Recommendations For Pivotal Spring-LDAP versions 1.3.0 through 2.3.1, consider updating the authentication strategy to prevent authentication with arbitrary passwords. As a temporary workaround, restrict access to the LDAP BindAuthenticator until a patch is available. Additionally, review the configuration of the userSearch and authentication settings to ensure they are properly secured. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

BDU:2021-01068

CVE-2017-8028

DLA-1180-1

DSA-4046-1

GHSA-PJQH-2JCC-5J84

MGASA-2018-0235

Affected Products

Spring Ldap

References · 19

• https://pivotal.io/security/cve-2017-8028 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2018-0235 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8028 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8028 · Security Note
• https://access.redhat.com/errata/RHSA-2018:0319 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2017-8028 · Security Note
• https://debian.org/security/2017/dsa-4046 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2018-0235.html · Security Note
• https://osv.dev/vulnerability/DSA-4046-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01068 · Security Note
• https://ubuntu.com/security/CVE-2017-8028 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2017-8028 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-pjqh-2jcc-5j84 · Vendor Advisory
• https://github.com/spring-projects/spring-ldap/issues/430 · Note
• https://github.com/spring-projects/spring-ldap/commit/08e8ae289bbd1b581986c7238604a147119c1336 · Note