Security Update for libspring-ldap-java
Summary
DLA-1180-1: libspring-ldap-java - security update. Affects libspring-ldap-java versions < 1.3.1.RELEASE-4+deb7u1. Fixed in 1.3.1.RELEASE-4+deb7u1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
libspring-ldap-java is a library that provides support for LDAP (Lightweight Directory Access Protocol) operations in Spring Framework applications. It allows developers to interact with LDAP servers for authentication, querying, and managing directory data. This vulnerability affects version 1.3.1.RELEASE-4+deb7u1 of the package in Debian 7 Wheezy.
Vulnerability Detail
The vulnerability discovered in libspring-ldap-java allows an attacker to authenticate with an arbitrary password when the username is correct, no additional attributes are bound, and LDAP BindAuthenticator is used with DefaultTlsDirContextAuthenticationStrategy as the authentication strategy while setting userSearch. This vulnerability arises due to certain LDAP vendors requiring an explicit operation for the LDAP bind to take effect. The impact of this vulnerability is that an attacker can gain unauthorized access to the LDAP server.
How To Fix
Minimum fixed version
1.3.1.RELEASE-4+deb7u1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade libspring-ldap-javaTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
It is crucial to upgrade the libspring-ldap-java package to the fixed version to mitigate the vulnerability. Failure to do so may result in unauthorized access to the LDAP server. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for libspring-ldap-java →
FAQ
libspring-ldap-java is a library that provides support for LDAP operations in Spring Framework applications.
LDAP (Lightweight Directory Access Protocol) is a protocol used for accessing and maintaining distributed directory information services over an IP network.
LDAP authentication is a process of verifying the identity of a user by checking their credentials against an LDAP server.
This vulnerability occurs when using LDAP BindAuthenticator with DefaultTlsDirContextAuthenticationStrategy as the authentication strategy and setting userSearch, while no additional attributes are bound.
The impact of this vulnerability is that an attacker can authenticate with an arbitrary password when the username is correct, leading to unauthorized access to the LDAP server.
Related vulnerabilities
Recent vulnerabilities recorded for libspring-ldap-java.
