Description
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
References
- 68249 vdb-entry
- [oss-security] 20140628 Re: CVE request / advisory: Cherokee mailing-list
- FEDORA-2015-6392 vendor-advisory
- MDVSA-2015:225 vendor-advisory
- FEDORA-2015-6279 vendor-advisory
- https://github.com/cherokee/webserver/commit/fbda667221c51f0aa476a02366e0cf66cb012f88
- [oss-security] 20140628 CVE request / advisory: Cherokee mailing-list
- FEDORA-2015-6194 vendor-advisory
- http://advisories.mageia.org/MGASA-2015-0181.html