Description
In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | golang-github-go-ldap-ldap | 2.5.1-1 | — |
| Debian 13 | golang-github-go-ldap-ldap | 2.5.1-1 | — |
| Debian 12 | golang-github-go-ldap-ldap | 2.5.1-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | golang-github-go-ldap-ldap | No fix yet | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | vitess | 19.0.4-2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | github.com/go-ldap/ldap | < 2.5.0 | 2.5.0 | GHSA-x27w-qxhg-343v |
| Go | github.com/go-ldap/ldap | < 2.5.0+incompatible | 2.5.0+incompatible | GO-2022-0887 |