X.509 Certificate Validation Gap in Apache Session LDAP by LemonLDAP

CVE-2020-36658

What is CVE-2020-36658?

Apache::Session::LDAP versions prior to 0.5 lack proper validation of X.509 certificates when establishing connections to remote LDAP servers. This issue stems from the default configuration of the Net::LDAPS module used in Perl applications, which does not enforce certificate checks. Consequently, attackers may exploit this oversight to conduct man-in-the-middle attacks or impersonate legitimate LDAP services. To mitigate the risk, it is crucial to implement necessary patches or adjustments in conjunction with associated fixes such as those from CVE-2020-16093.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References