CVE-2018-1337: Infoleak
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
Other sources
In Apache LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2018-1337?
CVE-2018-1337 is classified as a medium severity vulnerability.
How do I fix CVE-2018-1337?
To fix CVE-2018-1337, upgrade to Apache Directory LDAP API version 1.0.2 or later.
What types of information could be leaked due to CVE-2018-1337?
CVE-2018-1337 could potentially leak sensitive data transmitted during the SSL/TLS connection.
Which software is affected by CVE-2018-1337?
CVE-2018-1337 affects Apache Directory LDAP API versions prior to 1.0.2.
Can CVE-2018-1337 be exploited remotely?
Yes, CVE-2018-1337 can potentially be exploited remotely if the vulnerable server is accessible to attackers.