Summary
It was discovered that Apache::Session::LDAP incorrectly handled invalid X.509
certificates. If a user or an automated system were tricked into opening a
specially crafted invalid X.509 certificate, a remote attacker could possibly
use this issue to perform spoofing and obtain sensitive information.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | libapache-session-ldap-perl | 0.4-1+deb10u1build0.20.04.1 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | libapache-session-ldap-perl | 0.4-1ubuntu0.16.04.1~esm1 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | libapache-session-ldap-perl | 0.4-1ubuntu0.18.04.1~esm1 |
Vulnerabilities 1
-
High 8.1
In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to rem…
References
-
report
https://ubuntu.com/security/CVE-2020-36658