Описание
python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | pending | 3.4.4-2ubuntu3 |
| esm-apps/xenial | released | 2.4.22-0.1ubuntu0.1~esm1 |
| esm-infra/bionic | released | 3.0.0-1ubuntu0.2+esm1 |
| esm-infra/focal | released | 3.2.0-4ubuntu2.1+esm1 |
| jammy | released | 3.2.0-4ubuntu7.2 |
| noble | released | 3.4.4-1ubuntu0.24.04.1 |
| plucky | released | 3.4.4-1ubuntu0.25.04.1 |
| questing | released | 3.4.4-1ubuntu0.25.10.1 |
| upstream | released | 3.4.5 |
Показывать по
Ссылки на источники
5.3 Medium
CVSS3
Связанные уязвимости
python-ldap is a lightweight directory access protocol (LDAP) client API for Python. In versions prior to 3.4.5, ldap.dn.escape_dn_chars() escapes \x00 incorrectly by emitting a backslash followed by a literal NUL byte instead of the RFC-4514 hex form \00. Any application that uses this helper to construct DNs from untrusted input can be made to consistently fail before a request is sent to the LDAP server (e.g., AD), resulting in a client-side denial of service. Version 3.4.5 contains a patch for the issue.
python-ldap is a lightweight directory access protocol (LDAP) client A ...
python-ldap is Vulnerable to Improper Encoding or Escaping of Output and Improper Null Termination
5.3 Medium
CVSS3