oss-security - [SECURITY] CVE-2020-9495: Apache Archiva login service is vulnerable to LDAP injection

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <2640261.krIbtSRUe9@golgafrichnam>
Date: Fri, 19 Jun 2020 20:31:22 +0200
From: Martin <martin_s@...che.org>
To: users@...hiva.apache.org, announce@...che.org, dev@...hiva.apache.org
Cc: users@...en.apache.org, oss-security@...ts.openwall.com, bugtraq@...urityfocus.com
Subject: [SECURITY] CVE-2020-9495: Apache Archiva login service is vulnerable to LDAP injection

CVE-2020-9495: Apache Archiva login service is vulnerable to LDAP injection

Severity: Medium

Vendor:
The Apache Software Foundation

Versions Affected:

    Apache Archiva all versions before 2.2.5

By providing special values to the archiva login form a attacker is able to retrieve user attribute data from the connected LDAP server. 
With certain characters it is possible to modify the LDAP filter used to query the users on the connected LDAP server. 
By measuring the response time, arbitrary attribute data can be retrieved from LDAP user objects.

Mitigation:

    Upgrade to Apache Archiva 2.2.5 or higher

References:
http://archiva.apache.org/security.html#CVE-2020-9495

The newest Archiva version can be downloaded from:
http://archiva.apache.org/download.cgi

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.