[Bug 1844510] New: CVE-2016-6497 groovy: allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
Bug ID: 1844510 Summary: CVE-2016-6497 groovy: allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods Product: Security Response Hardware: All OS: Linux Status: NEW Component: vulnerability Keywords: Security Severity: medium Priority: medium Assignee: security-response-team@redhat.com Reporter: gsuckevi@redhat.com CC: aboyko@redhat.com, aileenc@redhat.com, akoufoud@redhat.com, alazarot@redhat.com, almorale@redhat.com, anstephe@redhat.com, asoldano@redhat.com, atangrin@redhat.com, bbaranow@redhat.com, bmaxwell@redhat.com, bmontgom@redhat.com, brian.stansberry@redhat.com, cdewolf@redhat.com, chazlett@redhat.com, darran.lofthouse@redhat.com, decathorpe@gmail.com, dkreling@redhat.com, dosoudil@redhat.com, drieden@redhat.com, eparis@redhat.com, etirelli@redhat.com, extras-orphan@fedoraproject.org, ggaughan@redhat.com, gmalinko@redhat.com, gvarsami@redhat.com, ibek@redhat.com, iweiss@redhat.com, janstey@redhat.com, java-maint@redhat.com, java-sig-commits@lists.fedoraproject.org, jawilson@redhat.com, jburrell@redhat.com, jcoleman@redhat.com, jochrist@redhat.com, jokerman@redhat.com, jolee@redhat.com, jperkins@redhat.com, jschatte@redhat.com, jstastny@redhat.com, jwon@redhat.com, kconner@redhat.com, krathod@redhat.com, kverlaen@redhat.com, kwills@redhat.com, ldimaggi@redhat.com, lgao@redhat.com, lkundrak@v3.sk, loleary@redhat.com, mizdebsk@redhat.com, mnovotny@redhat.com, msochure@redhat.com, msrb@redhat.com, msvehla@redhat.com, nstielau@redhat.com, nwallace@redhat.com, paradhya@redhat.com, pjindal@redhat.com, pmackay@redhat.com, psotirop@redhat.com, puntogil@libero.it, rguimara@redhat.com, rrajasek@redhat.com, rstancel@redhat.com, rsvoboda@redhat.com, rsynek@redhat.com, rwagner@redhat.com, sdaley@redhat.com, smaestri@redhat.com, spinder@redhat.com, sponnaga@redhat.com, tcunning@redhat.com, theute@redhat.com, tkirby@redhat.com, tom.jenkinson@redhat.com, vhalbert@redhat.com Target Milestone: --- Classification: Other
main/java/org/apache/directory/groovyldap/LDAP.java in the Groovy LDAP API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods.
References: https://mail-archives.apache.org/mod_mbox/directory-users/201610.mbox/%3Cb7d...
Upstream commit: http://svn.apache.org/viewvc/directory/sandbox/szoerner/groovyldap/src/main/...
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Depends On| |1844511, 1844512
Referenced Bugs:
https://bugzilla.redhat.com/show_bug.cgi?id=1844511 [Bug 1844511] CVE-2016-6497 groovy18: groovy: allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods [fedora-31] https://bugzilla.redhat.com/show_bug.cgi?id=1844512 [Bug 1844512] CVE-2016-6497 groovy: allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods [fedora-31]
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
--- Comment #1 from Guilherme de Almeida Suckevicz gsuckevi@redhat.com --- Created groovy tracking bugs for this issue:
Affects: fedora-31 [bug 1844512]
Created groovy18 tracking bugs for this issue:
Affects: fedora-31 [bug 1844511]
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
Guilherme de Almeida Suckevicz gsuckevi@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Blocks| |1844513
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
--- Comment #4 from Jason Shepherd jshepherd@redhat.com --- Statement:
The vulnerable class LDAP, is not found in OpenShift Container Platform's distribution of ElasticSearch.
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
Chess Hazlett chazlett@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Priority|medium |high Severity|medium |high
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
--- Comment #6 from Cedric Buissart 🐶 cbuissar@redhat.com --- Statement:
The vulnerable class LDAP, is not found in OpenShift Container Platform's distribution of ElasticSearch.
Groovy as shipped in Red Hat Enterprise Linux 7 does not embed the LDAP class, and thus is not affected by this vulnerability.
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
Product Security DevOps Team prodsec-dev@redhat.com changed:
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |WONTFIX Last Closed| |2020-06-11 17:20:28
--- Comment #7 from Product Security DevOps Team prodsec-dev@redhat.com --- This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):
https://access.redhat.com/security/cve/cve-2016-6497
https://bugzilla.redhat.com/show_bug.cgi?id=1844510
--- Doc Text *updated* by Eric Christensen sparks@redhat.com --- A flaw was found in Groovy LDAP. The API in Apache allows attackers to conduct LDAP entry poisoning attacks by leveraging the `returnObjFlag` setting. The highest threat from this vulnerability is to data integrity.
https://bugzilla.redhat.com/show_bug.cgi?id=1844510 Bug 1844510 depends on bug 1844512, which changed state.
Bug 1844512 Summary: CVE-2016-6497 groovy: allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods [fedora-31] https://bugzilla.redhat.com/show_bug.cgi?id=1844512
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
https://bugzilla.redhat.com/show_bug.cgi?id=1844510 Bug 1844510 depends on bug 1844511, which changed state.
Bug 1844511 Summary: CVE-2016-6497 groovy18: groovy: allows attackers to conduct LDAP entry poisoning attacks by leveraging setting returnObjFlag to true for all search methods [fedora-31] https://bugzilla.redhat.com/show_bug.cgi?id=1844511
What |Removed |Added ---------------------------------------------------------------------------- Status|NEW |CLOSED Resolution|--- |EOL
java-sig-commits@lists.fedoraproject.org
-
bugzilla＠redhat.com