CVE-2015-3250 Exposure of Sensitive Information to an Unauthorized Actor in Apache Directory LDAP API
HighCVSS 7.5
EPSS 5.1%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Apache Directory LDAP API before 1.0.0-M31 allows attackers to conduct timing attacks via unspecified vectors.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| org.apache.directory.api/api-ldap-model(Maven) | <= 1.0.0-M30 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | < 1.0.0-M31 | 1.0.0-M31 |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M14 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M15 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M16 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M17 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M18 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M19 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M20 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M21 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M22 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M23 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M24 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M25 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M26 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M27 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M28 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M29 | No fix listed |
| org.apache.directory.api/api-ldap-model(Maven) | = 1.0.0-M30 | No fix listed |
| debian/apache-directory-api(Debian:12) | < 1.0.0~M20-3 | 1.0.0~M20-3 |
| debian/apache-directory-api(Debian:13) | < 1.0.0~M20-3 | 1.0.0~M20-3 |
| debian/apache-directory-api(Debian:14) | < 1.0.0~M20-3 | 1.0.0~M20-3 |
| apache directory ldap api | <= 1.0.0 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com issue-tracking third-party-advisory
- directory.apache.org vendor-advisory
- [oss-security] 20150707 Re: [ANNOUNCE] Apache Directory LDAP API 1.0.0-M31 released mailing-list third-party-advisory
- [oss-sec] 20150707 [ANNOUNCE] Apache Directory LDAP API 1.0.0-M31 released mailing-list third-party-advisory
- github.com
- Debian Security Tracker CVE-2015-3250 vendor-advisory
- bugs.debian.org issue-tracking