karaf-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "ASF subversion and git services (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (KARAF-4892) Encode username in LDAPLoginModule to avoid "code" injection
Date Mon, 12 Dec 2016 13:22:59 GMT

    [ https://issues.apache.org/jira/browse/KARAF-4892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15741873#comment-15741873
] 

ASF subversion and git services commented on KARAF-4892:
--------------------------------------------------------

Commit ff5792d9b19997318c487bd23edb2c5063ca88c6 in karaf's branch refs/heads/karaf-4.0.x from
[~jbonofre]
[ https://git-wip-us.apache.org/repos/asf?p=karaf.git;h=ff5792d ]

[KARAF-4892] Encode user to avoid LDAP injection


> Encode username in LDAPLoginModule to avoid "code" injection
> ------------------------------------------------------------
>
>                 Key: KARAF-4892
>                 URL: https://issues.apache.org/jira/browse/KARAF-4892
>             Project: Karaf
>          Issue Type: Bug
>          Components: karaf-security
>            Reporter: Jean-Baptiste Onofré
>            Assignee: Jean-Baptiste Onofré
>             Fix For: 4.1.0, 4.0.8
>
>
> A malicious user can inject "LDAP" code in the username, causing bad behavior in the
LDAP login module.
> To prevent this, the LDAP login module should encode the user.



--
This message was sent by Atlassian JIRA
(v6.3.4#6332)

Mime
View raw message