This vulnerability involves improper neutralization of special elements in LDAP queries within Red Hat Quay's external LDAP authentication process. Specifically, when an LDAP referral is returned, the system fails to properly escape the username input, allowing injection of LDAP filter metacharacters. This can be exploited to conduct user-existence oracle attacks against referral DNs and potentially affect password binding behavior in multi-domain Active Directory setups. The issue does not allow direct authentication bypass but may leak user existence information. Red Hat has not provided an official fix or mitigation that meets their standards for ease of use, applicability, and stability.

An attacker can inject LDAP filter metacharacters during LDAP referral processing, enabling user-existence oracle attacks at the referral DN. This may allow the attacker to infer valid usernames and potentially influence password binding decisions in multi-domain Active Directory environments. The vulnerability has low confidentiality and integrity impact and no availability impact. Direct authentication bypass is prevented, and directory enumeration is limited.

Currently, no mitigation or fix is available that meets Red Hat's criteria for ease of use, deployment, applicability, or stability. Users should monitor the Red Hat advisory for updates. Customers with a Technical Account Manager (TAM) can consult directly with Red Hat for guidance. Upgrading to a fixed version, if and when released, is recommended.