Emmanuel Lécharny created DIRAPI-446:
----------------------------------------
Summary: StartTLS transition accepts plaintext LDAP PDUs injected
before handshake
Key: DIRAPI-446
URL: https://issues.apache.org/jira/browse/DIRAPI-446
Project: Directory Client API
Issue Type: Bug
Affects Versions: 2.1.8
Reporter: Emmanuel Lécharny
Fix For: 2.1.9
The application starts an _async search (messageId N)_ then calls _startTls()_.
The *MITM* forwards the genuine *StartTLS* success response and appends
plaintext _SearchResultEntry/Done_ *PDUs* with _messageId_ N.
*MINA* runs the whole segment through the pre-TLS chain before the _SslFilter_
is installed, and the application consumes forged entries 'over TLS'.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
