Threats tagged 'ghsa-xghw-p77p-3r7x'

Fabric CA versions prior to 1.5.21, when configured with an LDAP backend, are vulnerable to LDAP injection due to unescaped usernames in the LDAP UserFilter during authentication. This allows an unauthenticated attacker with network access to manipulate LDAP searches before password validation, potentially redirecting authentication attempts to victim accounts. Deployments not using LDAP backends are not affected. The issue is fixed in version 1.5.21.