CVE-2020-36658 (published 2023-01-27T05:15Z)

In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.

CVSS v3 base score: 8.1, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         

Fix information:
repo_url: https://github.com/LemonLDAPNG/Apache-Session-LDAP
commit_details: repo_url: https://github.com/LemonLDAPNG/Apache-Session-LDAP
author: Maxime Besson
author_date: 2020-09-04 11:19:28+02:00
msg: Add ldapVerify option for SSL cert validation
repository: repo_url: https://github.com/LemonLDAPNG/Apache-Session-LDAP
repo_name: LemonLDAPNG/Apache-Session-LDAP
description: Apache::Session::LDAP Perl module - Store Apache Session in LDAP
repo_language: Perl
owner: LemonLDAPNG
file_changes: filename: LDAP.pm
change_type: ModificationType.MODIFY
diff: @@ -44,6 +44,8 @@ Apache::Session::LDAP - An implementation of Apache::Session
     ldapObjectClass      => 'applicationProcess',
     ldapAttributeId      => 'cn',
     ldapAttributeContent => 'description',
+    ldapVerify           => 'require',
+    ldapCAFile           => '/etc/ssl/certs/ca-certificates.crt',
   };
 
 =head1 DESCRIPTION

programming_language: Perl
filename: LDAP.pm
change_type: ModificationType.MODIFY
diff: @@ -119,22 +119,32 @@ sub ldap {
         push @servers, $server;
     }
 
+    # Compatibility
+    my $caFile = $self->{args}->{ldapCAFile} || $self->{args}->{caFile};
+    my $caPath = $self->{args}->{ldapCAPath} || $self->{args}->{caPath};
+
     # Connect
     my $ldap = Net::LDAP->new(
         \@servers,
         onerror => undef,
+        verify  => $self->{args}->{ldapVerify} || "require",
+        ( $caFile ? ( cafile => $caFile ) : () ),
+        ( $caPath ? ( capath => $caPath ) : () ),
+
         (
             $self->{args}->{ldapPort}
             ? ( port => $self->{args}->{ldapPort} )
             : ()
         ),
-    ) or die( 'Unable to connect to ' . join( ' ', @servers ) );
+    ) or die( 'Unable to connect to ' . join( ' ', @servers ) . ': ' . $@ );
 
     # Start TLS if needed
+
     if ($useTls) {
         my %h = split( /[&=]/, $tlsParam );
-        $h{cafile} = $self->{args}->{caFile} if ( $self->{args}->{caFile} );
-        $h{capath} = $self->{args}->{caPath} if ( $self->{args}->{caPath} );
+        $h{verify} ||= ( $self->{args}->{ldapVerify} || "require" );
+        $h{cafile} ||= $caFile if ($caFile);
+        $h{capath} ||= $caPath if ($caPath);
         my $start_tls = $ldap->start_tls(%h);
         if ( $start_tls->code ) {
             $self->logError($start_tls);

programming_language: Perl