https://bugzilla.redhat.com/show_bug.cgi?id=1510968
--- Doc Text *updated* by Eric Christensen <sparks(a)redhat.com> ---
A vulnerability was found in spring-ldap that allows an attacker to authenticate with an
arbitrary password. When spring-ldap connected to some LDAP servers, when no additional
attributes are bound, when using LDAP BindAuthenticator with
org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the
authentication strategy, and when setting userSearch, authentication is allowed with an
arbitrary password when the username is correct.
--
You are receiving this mail because:
You are on the CC list for the bug.