Grouper Users - Open Discussion List

["Hyzer, Chris" <>]

This is fixed in 2.3.0 api patch #63. Especially since this is a security patch, you should apply it without delay.

 

https://bugs.internet2.edu/jira/browse/GRP-1532

 

I tested an LDAP source, and the LDAP loader, and they work fine.  If anyone has feedback let me know.  Note if you cant patch for whatever reason you can just copy the new vt-ldap.jar in place.

 

Thanks to Carey Black for pointing this out.

 

Thanks

Chris

 

Note, vt-ldap 3.3.9 is in the patch…

 

From: [] On Behalf Of Black, Carey M.
Sent: Tuesday, April 18, 2017 5:28 PM
To:
Subject: [grouper-core] Concern with vt-ldap that is packaged with Grouper

 

I believe there is a security issue with a version of the vt-ldap client that is packaged with Grouper at this time. ( Ver. 3.3.5 )

 

REF: vt-ldap bug

 

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-3607

“

David Jorm 2014-09-10 21:43:24 EDT

It was discovered that the implementation used by the vtldap/ldaptive project to check that the server hostname matches the domain name in the subject's CN field was flawed. This can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.

“            

 

 

Fixed In Version:              vt-ldap 3.3.8, ldaptive 1.0.5

 

As well as this ref:  https://shibboleth.net/community/advisories/secadv_20140919.txt

 

 

Please upgrade to at least the latest version of vt-ldap.

                It also may be advisable to, in the long term, to move to http://www.ldaptive.org/ . It looks like vt-ldap may have been informally deprecated somewhere around 2013.

 

--

Carey Matthew

Office of the Chief Information Officer (OCIO)

Identity and Access Management – Security Engineer-Lead

614-292-6079 Office