Design/Logic Flaw

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer...

CVE-2017-11501

CVE-2017-11501 affects NixOS 17.03 and earlier via the users.ldap PAM module used for LDAP authentication. When TLS is used to connect to the LDAP server (users.ldap.useTLS), the peer certificate verification is unconditionally disabled in /etc/ldap.conf. This creates a risk of man-in-the-middle ...

USN-2292-1 liblwp-protocol-https-perl vulnerability

It was discovered that the LWP::Protocol::https perl module incorrectly disabled peer certificate verification completely when only hostname verification was requested to be disabled. If a remote attacker were able to perform a machine-in-the-middle attack, this flaw could possibly be exploited i...

cert name check ignore with GnuTLS

This issue is almost identical to the one named CVE-2013-4545, but this problem affects a different SSL backend. libcurl is vulnerable to a case of missing out the checking of the certificate CN or SAN name field when the digital signature verification is turned off. libcurl offers two separate a...