CVE-2015-1816

Forman before 1.7.4 does not verify SSL certificates for LDAP connections, which allows man-in-the-middle attackers to spoof LDAP servers via a crafted certificate.

Score

CVSS 2.0 5.0 Medium

Status

Modified - secalert@redhat.com

Published

2015-08-14

Last modified

2024-08-06

Weaknesses

CWE-310

Affected products

• Foreman (Theforeman)

References

• http://projects.theforeman.org/issues/9858
• https://access.redhat.com/errata/RHSA-2015:1591
• https://access.redhat.com/errata/RHSA-2015:1592
• https://github.com/theforeman/foreman/pull/2265
• https://groups.google.com/forum/#%21topic/foreman-announce/9ZnuPcplNLI