Django REST framework

Lookup for vulnerable packages by Package URL.

Purl pkg:maven/org.apache.directory.api/apache-ldap-api@1.0.2

Type maven

Namespace org.apache.directory.api

Name apache-ldap-api

Version 1.0.2

Qualifiers

Subpath

Is_vulnerable false

Next_non_vulnerable_version null

Latest_non_vulnerable_version null

Affected_by_vulnerabilities

Fixing_vulnerabilities

url VCID-hm2f-t4wa-tuhu

vulnerability_id VCID-hm2f-t4wa-tuhu

summary

Exposure of Sensitive Information to an Unauthorized Actor
In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).

references

reference_url	https://nvd.nist.gov/vuln/detail/CVE-2018-1337
reference_id	CVE-2018-1337
reference_type
scores
url	https://nvd.nist.gov/vuln/detail/CVE-2018-1337

reference_url	https://github.com/advisories/GHSA-cfw5-v7cw-69cw
reference_id	GHSA-cfw5-v7cw-69cw
reference_type
scores
url	https://github.com/advisories/GHSA-cfw5-v7cw-69cw

fixed_packages

url	pkg:maven/org.apache.directory.api/apache-ldap-api@1.0.2
purl	pkg:maven/org.apache.directory.api/apache-ldap-api@1.0.2
is_vulnerable	`false`
affected_by_vulnerabilities
resource_url	http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.directory.api/apache-ldap-api@1.0.2

aliases CVE-2018-1337, GHSA-cfw5-v7cw-69cw

risk_score null

exploitability null

weighted_severity null

resource_url http://public2.vulnerablecode.io/vulnerabilities/VCID-hm2f-t4wa-tuhu

Risk_score null

Resource_url http://public2.vulnerablecode.io/packages/pkg:maven/org.apache.directory.api/apache-ldap-api@1.0.2

Package Instance