Description
Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Apache Software Foundation | Apache Karaf | prior to 4.0.8 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.apache.karaf:apache-karaf | < 4.0.8 | 4.0.8 | GHSA-chj8-5xgw-wcvj |
References
- RHSA-2018:1322 vendor-advisory
- https://karaf.apache.org/security/cve-2016-8750.txt
- 103098 vdb-entry