Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix escaping in LDAP search strings [CVE-2020-14013] #239

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Commits on Jun 10, 2020

  1. Fix escaping in LDAP search strings.

    When username contains any special character (parentheses, asterisk, ...)
    user search will fail.
    
    When returned DN of user contains any escaped character (for example ",")
    group filter will fail.
    
    Example:
    (&(CN=group)(member=CN=dummy\, dummy2,OU=ou,DC=dc))"
    
    Which is wrong and doesn't work with Active directory.
    
    Correct is:
    (&(CN=group)(member=CN=dummy\5C, dummy2,OU=ou,DC=dc))"
    
    This patch fixies both of these bugs by using ldap_bv2escaped_filter_value
    from LDAP client to escape all of filter values.
    
    See: https://tools.ietf.org/search/rfc2254#page-5
    Fix: kvspb#224 kvspb#180
    onovy committed Jun 10, 2020
    Configuration menu
    Copy the full SHA
    308a3cd View commit details
    Browse the repository at this point in the history