NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf.
References
| Link | Resource |
|---|---|
| http://openwall.com/lists/oss-security/2017/07/20/1 | Mailing List Mitigation Patch Third Party Advisory |
| https://github.com/NixOS/nixpkgs/issues/27506 | Issue Tracking Third Party Advisory |
| https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk | |
| http://openwall.com/lists/oss-security/2017/07/20/1 | Mailing List Mitigation Patch Third Party Advisory |
| https://github.com/NixOS/nixpkgs/issues/27506 | Issue Tracking Third Party Advisory |
| https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk |
Configurations
History
21 Nov 2024, 03:07
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://openwall.com/lists/oss-security/2017/07/20/1 - Mailing List, Mitigation, Patch, Third Party Advisory | |
| References | () https://github.com/NixOS/nixpkgs/issues/27506 - Issue Tracking, Third Party Advisory | |
| References | () https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk - |
Information
Published : 2017-07-20 23:29
Updated : 2025-04-20 01:37
NVD link : CVE-2017-11501
Mitre link : CVE-2017-11501
CVE.ORG link : CVE-2017-11501
JSON object : View
Products Affected
nixos_project
- nixos
CWE
CWE-295
Improper Certificate Validation