PT-2018-11784 · Apache · Apache Directory Ldap Api

Published 2018-07-10 · Updated 2020-08-24 · CVE-2018-1337

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Apache Directory LDAP API versions prior to 1.0.2

Description A bug in the setup of the SSL Filter allows another thread to use a connection before the TLS layer is established, potentially leaking information, including credentials sent in a BIND request.

Recommendations For versions prior to 1.0.2, update to version 1.0.2 or later to resolve the issue. As a temporary workaround, consider disabling connection pooling to minimize the risk of exploitation. Restrict access to sensitive operations, such as BIND requests, until the issue is resolved.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2018-1337

GHSA-CFW5-V7CW-69CW

Affected Products

Apache Directory Ldap Api

References · 21

• https://nvd.nist.gov/vuln/detail/CVE-2018-1337 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2018-1337 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1337 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-cfw5-v7cw-69cw · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2018-1337 · Vendor Advisory
• https://lists.apache.org/thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749%40%3Cjira.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/r55e74532e7f9e84ecfa56b4e0a50a5fe0ba6f7a76880520e4400b0d7@%3Cjira.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/r1a258430d820a90ff9d4558319296cc517ff2252327d7b3546d16749@%3Cjira.kafka.apache.org%3E · Note
• http://securityfocus.com/bid/104744 · Note
• https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d1419586eed28297d820768f%40%3Cdev.directory.apache.org%3E · Note
• https://lists.apache.org/thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b@%3Cdev.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/r4da40aa50cfdb2158898f2bc6df81feec1d42c6a06db6537d5cc0496%40%3Cjira.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/r0e645b3f6ca977dc60b7cec231215c59a9471736c2402c1fef5a0616%40%3Cjira.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/r1815fb5b0c345f571c740e7a1b48d7477647edd4ffcf9d5321e69446%40%3Cdev.kafka.apache.org%3E · Note
• https://lists.apache.org/thread.html/r56b304fb9960c869995efbb31da3b9b7c6d53ee31f7f7048eb80434b%40%3Cdev.kafka.apache.org%3E · Note