In the ldap.v2 (aka go-ldap) package through 2.5.0 for Go an attacker may be able to login with an empty password. This issue affects an application using this package if these conditions are met: (1) it relies only on the return error of the Bind function call to determine whether a user is authorized (i.e. a nil return value is interpreted as successful authorization) and (2) it is used with an LDAP server allowing unauthenticated bind.

🗓️ 11 Sep 2024 07:00:00Reported by MicrosoftType

Go ldap.v2 up to 2.5.0 permits login with an empty password if Bind error alone grants access.

Reporter	Title	Published	Views	Family All 22
Tenable Nessus	Azure Linux 3.0 Security Update: vitess (CVE-2017-14623)	22 Jan 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2017-14623	27 Aug 202500:00	–	nessus
IBM Security Bulletins	Security Bulletin: IBM CICS TX Standard is vulnerable to multiple vulnerabilities in Golang Go.	14 Feb 202321:14	–	ibm
IBM Security Bulletins	Security Bulletin: IBM CICS TX Advanced is vulnerable to multiple vulnerabilities in Golang Go.	14 Feb 202321:04	–	ibm
CBLMariner	CVE-2017-14623 affecting package vitess for versions less than 19.0.4-2	22 Jul 202419:00	–	cbl_mariner
CNVD	go-ldap ldap trust management vulnerability	21 Sep 201700:00	–	cnvd
CVE	CVE-2017-14623	20 Sep 201723:00	–	cve
Cvelist	CVE-2017-14623	20 Sep 201723:00	–	cvelist
Debian CVE	CVE-2017-14623	20 Sep 201723:00	–	debiancve
Github Security Blog	Access Restriction Bypass in go-ldap	15 Feb 202201:57	–	github