CVE-2017-14623 Access Restriction Bypass in go-ldap
An attacker can bypass authentication in applications using the go-ldap package if the server allows unauthenticated binds and the app ignores bind errors.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-14623?
CVE-2017-14623 is a high-severity authentication bypass vulnerability in n/a, published on 20 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go, an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e., a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.
Weakness: CWE-287
Which versions are affected by CVE-2017-14623?
3 open source packages ship an affected version, including github.com/go-ldap/ldap. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
github.com/go-ldap/ldap Go | All versions | 2.5.0 |
github.com/go-ldap/ldap Go | All versions | 2.5.0 |
github.com/go-ldap/ldap Go | All versions | 2.5.0+incompatible |
Products include Go-Ldap Project Ldap.
How do I fix CVE-2017-14623?
Upgrade github.com/go-ldap/ldap to a fixed version for your release line: 2.5.0 or 2.5.0+incompatible.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2017-14623 being exploited?
There is no known exploitation of CVE-2017-14623 in the wild and no public exploit code.
Sources
Also known as AZL-40850, DEBIAN-CVE-2017-14623, GHSA-x27w-qxhg-343v, GO-2022-0887, UBUNTU-CVE-2017-14623.