UBUNTU-CVE-2017-8028

See a problem?
Please try reporting it to the source first.

Source

https://ubuntu.com/security/CVE-2017-8028

Import Source

https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-8028.json

JSON Data

https://api.osv.dev/v1/vulns/UBUNTU-CVE-2017-8028

Upstream

CVE-2017-8028

Published

2017-11-27T10:29:00Z

Modified

2025-09-08T16:44:14Z

Severity

8.1 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Ubuntu - medium

Summary

[none]

Details

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, when no additional attributes are bound, and when using LDAP BindAuthenticator with org.springframework.ldap.core.support.DefaultTlsDirContextAuthenticationStrategy as the authentication strategy, and setting userSearch, authentication is allowed with an arbitrary password when the username is correct. This occurs because some LDAP vendors require an explicit operation for the LDAP bind to take effect.

References

Affected packages

Ubuntu:14.04:LTS / libspring-ldap-java

Package

Name: libspring-ldap-java
Purl: pkg:deb/ubuntu/libspring-ldap-java@1.3.1.RELEASE-4+deb7u1build0.14.04.1?arch=source&distro=trusty

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.3.1.RELEASE-4+deb7u1build0.14.04.1

Affected versions

1.*

1.3.1.RELEASE-4

Ecosystem specific

{
    "availability": "No subscription required",
    "binaries": [
        {
            "binary_name": "libspring-ldap-java",
            "binary_version": "1.3.1.RELEASE-4+deb7u1build0.14.04.1"
        }
    ]
}

Database specific

source

"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2017/UBUNTU-CVE-2017-8028.json"