Bug 1524432 – CVE-2016-8750 karaf: LDAP injection in LDAPLoginModule

Bugzilla will be upgraded to version 5.0 on a still to be determined date in the near future. The original upgrade date has been delayed.

Bug 1524432 - (CVE-2016-8750) CVE-2016-8750 karaf: LDAP injection in LDAPLoginModule

Summary:	CVE-2016-8750 karaf: LDAP injection in LDAPLoginModule

Status:	NEW

Aliases:	CVE-2016-8750

Product:	Security Response
Classification:	Other
Component:	vulnerability (Show other bugs)
Sub Component:
Version:	unspecified
Hardware:	All Linux

Priority	medium Severity medium
Target Milestone:	---
Target Release:	---
Assigned To:	Red Hat Product Security
QA Contact:
Docs Contact:

URL:
Whiteboard:	impact=moderate,public=20161212,repor...
Keywords:	Security

Depends On:	1530422
Blocks:	1524434 1530427
	Show dependency tree / graph

Reported:	2017-12-11 08:47 EST by Andrej Nemec
Modified:	2018-05-03 15:05 EDT (History)
CC List:	18 users (show)

See Also:
Fixed In Version:	karaf 4.0.8
Doc Type:	If docs needed, set a value
Doc Text:	Apache Karaf uses the LDAPLoginModule to authenticate users to a directory via LDAP. It does not, however, encode usernames properly and hence is vulnerable to LDAP injection attacks. While it appears that it is not possible to exploit this vulnerability to allow an attacker to gain remote access, it does allow an attacker to insert special characters into the search query step. Therefore, it can potentially be exploited as part of a Denial of Service attack.
Story Points:	---
Clone Of:
Environment:
Last Closed:
Type:	---
Regression:	---
Mount Type:	---
Documentation:	---
CRM:
Verified Versions:
Category:	---
oVirt Team:	---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---

Attachments	(Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

External Trackers
Tracker	ID	Priority	Status	Summary	Last Updated
Red Hat Product Errata	RHSA-2018:1322	None	None	None	2018-05-03 15:05 EDT

Groups: None (edit)

Description Andrej Nemec 2017-12-11 08:47:48 EST

Apache Karaf uses the LDAPLoginModule to authenticate users to a directory
via LDAP. However, it is not encoding usernames properly and hence is
vulnerable to LDAP injection attacks.

While it appears that it not possible to exploit this vulnerability to allow
an attacker to gain remote access, it allows an attacker to insert special
characters into the search query step. Therefore, it can potentially be
exploited as part of a Denial Of Service attack.

External References:

https://karaf.apache.org/security/cve-2016-8750.txt

Upstream patch:

https://github.com/apache/karaf/commit/ac07cb2440ceff94b3001728c1611fc471253d19

Comment 4 errata-xmlrpc 2018-05-03 15:04:57 EDT

This issue has been addressed in the following products:

  Red Hat JBoss Fuse

Via RHSA-2018:1322 https://access.redhat.com/errata/RHSA-2018:1322

Note You need to log in before you can comment on or make changes to this bug.