CVE-2020-36658: Improper Certificate Validation (CWE-295)
value: In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
CWE description: The product does not validate, or incorrectly validates, a certificate.
CVSS v3 base score: 8.1
Published: 2023-01-27T05:15Z
Repository: https://github.com/LemonLDAPNG/Apache-Session-LDAP
Language: Perl
Files changed: lib/Apache/Session/LDAP.pm, lib/Apache/Session/Store/LDAP.pm
Commit date: 2020-09-04 15:30:07 +0200
Commit message: Add ldapVerify option for SSL cert validation

Diff: diff --git a/lib/Apache/Session/LDAP.pm b/lib/Apache/Session/LDAP.pm
index 63c9498..6bf2258 100644
--- a/lib/Apache/Session/LDAP.pm
+++ b/lib/Apache/Session/LDAP.pm
@@ -42,10 +42,12 @@ Apache::Session::LDAP - An implementation of Apache::Session
     ldapBindDN           => 'cn=admin,dc=example,dc=com',
     ldapBindPassword     => 'pass',
     ldapObjectClass      => 'applicationProcess',
     ldapAttributeId      => 'cn',
     ldapAttributeContent => 'description',
+    ldapVerify           => 'require',
+    ldapCAFile           => '/etc/ssl/certs/ca-certificates.crt',
   };
 
 =head1 DESCRIPTION
 
 This module is an implementation of Apache::Session. It uses an LDAP directory
diff --git a/lib/Apache/Session/Store/LDAP.pm b/lib/Apache/Session/Store/LDAP.pm
index 29b936b..7116e41 100644
--- a/lib/Apache/Session/Store/LDAP.pm
+++ b/lib/Apache/Session/Store/LDAP.pm
@@ -117,26 +117,36 @@ sub ldap {
             $useTls = 0;
         }
         push @servers, $server;
     }
 
+    # Compatibility
+    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
+    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};
+
     # Connect
     my $ldap = Net::LDAP->new(
         \@servers,
         onerror => undef,
+        verify  => $self->{args}->{ldapVerify} || "require",
+        ( $caFile ? ( cafile => $caFile ) : () ),
+        ( $caPath ? ( capath => $caPath ) : () ),
+
         (
             $self->{args}->{ldapPort}
             ? ( port => $self->{args}->{ldapPort} )
             : ()
         ),
-    ) or die( 'Unable to connect to ' . join( ' ', @servers ) );
+    ) or die( 'Unable to connect to ' . join( ' ', @servers ) . ': ' . $@ );
 
     # Start TLS if needed
+
     if ($useTls) {
         my %h = split( /[&=]/, $tlsParam );
-        $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
-        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );
+        $h{verify} ||= ( $self->{args}->{ldapVerify} || "require" );
+        $h{cafile} ||= $caFile if ($caFile);
+        $h{capath} ||= $caPath if ($caPath);
         my $start_tls = $ldap->start_tls(%h);
         if ( $start_tls->code ) {
             $self->logError($start_tls);
             return;
         }

Vulnerable code:     ) or die( 'Unable to connect to ' . join( ' ', @servers ) );
        $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );
Fixed code:     ldapVerify           => 'require',
    ldapCAFile           => '/etc/ssl/certs/ca-certificates.crt',
    # Compatibility
    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};

        verify  => $self->{args}->{ldapVerify} || "require",
        ( $caFile ? ( cafile => $caFile ) : () ),
        ( $caPath ? ( capath => $caPath ) : () ),

    ) or die( 'Unable to connect to ' . join( ' ', @servers ) . ': ' . $@ );

        $h{verify} ||= ( $self->{args}->{ldapVerify} || "require" );
        $h{cafile} ||= $caFile if ($caFile);
        $h{capath} ||= $caPath if ($caPath);