CVE-2017-11501 NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It w...
MediumCVSS 5.9
EPSS 0.88%
- Published
- Updated
- Exploit status
- No public exploit known
Description
NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| nixos project nixos | <= 17.03 | No fix listed |
References
- openwall.com mailing-list mitigation patch third-party-advisory
- github.com issue-tracking third-party-advisory
- groups.google.com