CVE-2005-2069 — Cleartext Transmission of Sensitive Info in Libnss-ldap

CWE-319 — Cleartext Transmission of Sensitive Info9 documents8 sources
Severity
5.0MEDIUMNVD
EPSS
2.8%
top 13.79%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Debian Libnss-ldapDebian Libpam-ldapMsrc CBL Mariner 1.0 ARM+1 more
Timeline
PublishedJun 30
Latest updateMay 1

Description

pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is referred to a master, which may cause a password to be sent in cleartext and allows remote attackers to sniff the password.

CVSS vector

AV:N/AC:L/C:P/I:N/A:NExploitability: 10.0 | Impact: 2.9

Affected Packages4 packages

▶debiandebian/libnss-ldap< libnss-ldap 238-1.1 (bullseye)
▶debiandebian/libpam-ldap< libnss-ldap 238-1.1 (bullseye)

Patches

Patch: bugzilla.padl.com ↗Patch: www.openldap.org ↗Patch: bugzilla.padl.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-fv7v-76vm-38q4: pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is re↗2022-05-01
▶
OSV
CVE-2005-2069: pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using TLS, does not use TLS for the subsequent connection if the client is re↗2005-06-30
▶

📋Vendor Advisories

4
Microsoft
CVE-2005-2069: NIST NVD Details: https://nvd↗2020-09-08
▶
Ubuntu
PAM/NSS LDAP vulnerabilitiy↗2005-07-21
▶
Red Hat
security flaw↗2005-06-28
▶
Debian
CVE-2005-2069: libnss-ldap - pam_ldap and nss_ldap, when used with OpenLDAP and connecting to a slave using T...↗2005
▶

💬Community

1
Bugzilla
CVE-2005-2069 security flaw↗2018-08-16
▶