[ https://issues.apache.org/jira/browse/KARAF-4892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15741873#comment-15741873 ]
ASF subversion and git services commented on KARAF-4892: -------------------------------------------------------- Commit ff5792d9b19997318c487bd23edb2c5063ca88c6 in karaf's branch refs/heads/karaf-4.0.x from [~jbonofre] [ https://git-wip-us.apache.org/repos/asf?p=karaf.git;h=ff5792d ] [KARAF-4892] Encode user to avoid LDAP injection > Encode username in LDAPLoginModule to avoid "code" injection > ------------------------------------------------------------ > > Key: KARAF-4892 > URL: https://issues.apache.org/jira/browse/KARAF-4892 > Project: Karaf > Issue Type: Bug > Components: karaf-security > Reporter: Jean-Baptiste Onofré > Assignee: Jean-Baptiste Onofré > Fix For: 4.1.0, 4.0.8 > > > A malicious user can inject "LDAP" code in the username, causing bad behavior > in the LDAP login module. > To prevent this, the LDAP login module should encode the user. -- This message was sent by Atlassian JIRA (v6.3.4#6332)