Ecosyste.ms: Advisories

Security Advisories: GSA_kwCzR0hTQS1xd2dtLW14bTQtM3EyY84AAq_4

net-ldap has weak salt when generating passwords

The Ruby net-ldap gem before 0.16.2 uses a weak salt when generating SSHA passwords.

Permalink: https://github.com/advisories/GHSA-qwgm-mxm4-3q2c
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1xd2dtLW14bTQtM3EyY84AAq_4
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: over 2 years ago
Updated: about 2 years ago

CVSS Score: 5.5
CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

EPSS Percentage: 0.00057
EPSS Percentile: 0.25513

Identifiers: GHSA-qwgm-mxm4-3q2c, CVE-2014-0083
References:

• https://nvd.nist.gov/vuln/detail/CVE-2014-0083
• https://github.com/ruby-ldap/ruby-net-ldap/commit/b412ca05f6b430eaa1ce97ac95885b4cf187b04a
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0083
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0083
• https://security-tracker.debian.org/tracker/CVE-2014-0083
• https://github.com/advisories/GHSA-qwgm-mxm4-3q2c

Repository: https://github.com/ruby-ldap/ruby-net-ldap
Blast Radius: 21.3

Affected Packages