CVE-2018-1337: Critical vulnerability in org.apache.directory.api:apache-ldap-api
Summary
CVE-2018-1337: Credential leak in org.apache.directory.api:apache-ldap-api. Affects org.apache.directory.api:apache-ldap-api versions < 1.0.2. Fixed in 1.0.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The org.apache.directory.api:apache-ldap-api package is a Maven ecosystem package that provides a set of Java libraries for working with LDAP (Lightweight Directory Access Protocol). It offers functionality for connecting to LDAP servers, performing operations, and managing directory data. This package is widely used in various applications that require LDAP integration.
Vulnerability Detail
This vulnerability, identified as CVE-2018-1337, is classified as critical. It stems from a bug in the SSL Filter setup of Apache LDAP API before version 1.0.2. The bug allows another thread to use a connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections. This can result in the leakage of sensitive information contained in the request, including credentials sent in a BIND request. The vulnerability poses a significant risk as it can lead to unauthorized access and potential data breaches.
How To Fix
Latest published version: 2.1.9 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.0.2
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to update to the fixed version of the package to address the issue effectively.
Conclusion
In conclusion, the CVE-2018-1337 vulnerability in org.apache.directory.api:apache-ldap-api poses a critical risk of unauthorized access and information leakage. To mitigate this risk, it is essential to update the package to version 1.0.2 or later. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.apache.directory.api:apache-ldap-api →
FAQ
Apache LDAP API is a set of Java libraries for working with LDAP servers, providing functionality for connecting, performing operations, and managing directory data.
The vulnerability allows unauthorized access to sensitive information, including credentials, potentially leading to data breaches and unauthorized actions.
To fix this vulnerability, update the org.apache.directory.api:apache-ldap-api package to version 1.0.2 or later.
No specific workaround is available. Updating to the fixed version is the recommended solution.
You can find more information about this vulnerability in the CVE-2018-1337 advisory and the Apache LDAP API documentation.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
