A vulnerability has been found in net-ldap gem up to 0.16.1 (Directory Service Software) and classified as critical. Affected by this vulnerability is the function Net::LDAP in the library lib/net/ldap/password.rb of the component SSHA Password Generation. The manipulation with an unknown input leads to a weak password hash vulnerability (Salt). The CWE definition for the vulnerability is CWE-916. The product generates a hash for a password, but it uses a scheme that does not provide a sufficient level of computational effort that would make password cracking attacks infeasible or expensive. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

The Ruby net-ldap gem before 0.16.2 uses a weak salt when generating SSHA passwords.

The weakness was shared 11/21/2019 (GitHub Repository). The advisory is shared at github.com. This vulnerability is known as CVE-2014-0083 since 12/03/2013. The exploitation appears to be easy. An attack has to be approached locally. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1552 for this issue.

Upgrading to version 0.16.2 eliminates this vulnerability.

Productinfo

Type

• Directory Service Software

Name

• net-ldap gem

Version

• 0.16.0
• 0.16.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion