CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP

published July 20, 2017

CVSS
—
EPSS
1%
Percentile
58.3
In the wild
Unconfirmed
What it is

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00875 · 58.3th percentile
Published
2017-07-20T23:00Z
EPSS history
Timeline
  • 20 JUL 23:00Z
    NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP
    cvelistv5