LDAP Authentication Issues in NixOS by NixOS

CVE-2017-11501

What is CVE-2017-11501?

NixOS versions 17.03 and earlier have a flaw where SSL certificate validation is not performed during LDAP authentication when utilizing the users.ldap module. This occurs if TLS is enabled for LDAP server connections. Consequently, the peer verification is disabled in the /etc/ldap.conf configuration file, leading to potential security risks, as the authenticity of the LDAP server cannot be guaranteed. It is crucial for users of affected NixOS versions to take preventative measures and apply patches to mitigate this vulnerability.

References