[
https://issues.apache.org/jira/browse/DIRAPI-446?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18120629#comment-18120629
]
Emmanuel Lécharny commented on DIRAPI-446:
------------------------------------------
Found by Claude
> StartTLS transition accepts plaintext LDAP PDUs injected before handshake
> -------------------------------------------------------------------------
>
> Key: DIRAPI-446
> URL: https://issues.apache.org/jira/browse/DIRAPI-446
> Project: Directory Client API
> Issue Type: Bug
> Affects Versions: 2.1.8
> Reporter: Emmanuel Lécharny
> Priority: Major
> Fix For: 2.1.9
>
>
> The application starts an _async search (messageId N)_ then calls
> _startTls()_.
> The *MITM* forwards the genuine *StartTLS* success response and appends
> plaintext _SearchResultEntry/Done_ *PDUs* with _messageId_ N.
> *MINA* runs the whole segment through the pre-TLS chain before the
> _SslFilter_ is installed, and the application consumes forged entries 'over
> TLS'.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
