| -----BEGIN PGP SIGNED MESSAGE----- |
| Hash: SHA1 |
| |
| CVE-2016-8750: Apache Karaf's LDAPLoginModule is vulnerable to LDAP |
| injection |
| |
| Severity: Moderate |
| |
| Vendor: The Apache Software Foundation |
| |
| Versions Affected: |
| |
| This vulnerability affects all versions of Apache Karaf prior to 4.0.8 |
| |
| Description: |
| |
| Apache Karaf uses the LDAPLoginModule to authenticate users to a directory |
| via LDAP. However, it is not encoding usernames properly and hence is |
| vulnerable to LDAP injection attacks. |
| |
| While it appears that it not possible to exploit this vulnerability to allow |
| an attacker to gain remote access, it allows an attacker to insert special |
| characters into the search query step. Therefore, it can potentially be |
| exploited as part of a Denial Of Service attack. |
| |
| This has been fixed in revision: |
| |
| https://git-wip-us.apache.org/repos/asf?p=karaf.git;h=ac07cb2 |
| |
| Migration: |
| |
| Apache Karaf users should upgrade to 4.0.8 or later as soon as possible. |
| |
| Credit: This issue was reported by Colm O hEigeartaigh of Talend. |
| -----BEGIN PGP SIGNATURE----- |
| Version: GnuPG v1 |
| |
| iQIcBAEBAgAGBQJYkc56AAoJEL/y7kLIKC52660QAKHpTfaclfh8BfxLuDwENynF |
| robX69nTsCrKUL9ryxmkw3dCIGkv/ltJyadUvr3dZpzksUngo95al5E5rG7ZQ9q9 |
| uZsvxpvIIhzLPgpRF6QrkW/LkOYxGTtPm5SWrE0tHkXY7G38BIJQXPITWQymzMST |
| F1HkPJwgfhkjzdgpHL4u6o/RAuOvljiiC0jb/f5SXtZZj4ZRF98+0eZxU4pzr44s |
| 8a0Jtl5HqAoBte1hUNmH4hHqldm61ojNEJiJXdFSlm4zT9Clm6adQ+uwojw27B5K |
| EsFbgmpek7NwYYF1cH8Q+DPGtgmH/sWaPp1DzsjrrCpQXMF/s1mTuJVKxyycsYBV |
| +uV8L1m4zYsmVP5ysmquCmWm/mpACJhe6/ONr4diLVUCvR2kwwyqVw/ArfoLaQw7 |
| 4G48QbcM7c5AK1WjV9C4LsaC0hB8PAWHM54GZRDDvxZ9IVR+vhCIP8UbAi3Ega+n |
| B36pOqPK1sC9ceNt+Xrp4zf9uRzlvu7t22zXQf6HKIu3FxUyGEzUY6w/BAvn2vYL |
| 0VJzgQwZHPj85fiRyjPZZfcp/e2m/hgZDeZcQljTpA434tzP9JMGiJbTwujufK5l |
| UZvDk97FvylyBAl2RD0GdooVQTIcfIW4Mxcj3oFb4l6w0CyTpiy2xXfWkDT3gGE4 |
| v1h47xUxrXuThMfDZ7A7 |
| =V/zt |
| -----END PGP SIGNATURE----- |
