...[ More ]

Apache Karaf's JAAS LDAP login module is affected by LDAP filter injection. The user and role LDAP search filters are built in LDAPCache by string substitution: each placeholder %u for the username, %dn for the user DN, %fqdn for the fully qualified DN is inserted with java.util.regex...