https://bugzilla.redhat.com/show_bug.cgi?id=1599886
Bug ID: 1599886
Summary: CVE-2018-1337 apache-ldap-api: Plaintext Password
Disclosure in Secured Channel
Product: Security Response
Component: vulnerability
Keywords: Security
Severity: medium
Priority: medium
Assignee: security-response-team(a)redhat.com
Reporter: psampaio(a)redhat.com
CC: chazlett(a)redhat.com, drieden(a)redhat.com,
java-sig-commits(a)lists.fedoraproject.org,
jolee(a)redhat.com, jschatte(a)redhat.com,
jstastny(a)redhat.com, puntogil(a)libero.it,
vhalbert(a)redhat.com
In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made
it possible for another thread to use the connection before the TLS layer has
been established, if the connection has already been used and put back in a
pool of connections, leading to leaking any information contained in this
request (including the credentials when sending a BIND request).
References:
https://lists.apache.org/thread.html/d66081195e9a02ee7cc20fb243b60467d141...
--
You are receiving this mail because:
You are on the CC list for the bug.