Description
The user_ldap (aka LDAP user and group backend) application in ownCloud before 5.0.18, 6.x before 6.0.6, and 7.x before 7.0.3 allows remote attackers to bypass authentication via a null byte in the password and a valid user name, which triggers an unauthenticated bind.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | znc | 1.6.3-2.6 | openSUSE-SU-2024:10104-1 |
Advisories 1
- openSUSE-SU-2024:10104-1 znc-1.6.3-2.6 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026