In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for another thread to use the connection before the TLS layer has been established, if the connection has already been used and put back in a pool of connections, leading to leaking any information contained in this request (including the credentials when sending a BIND request).

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for     another thread to use the connection before the TLS layer has been established, if the connection has     already been used and put back in a pool of connections, leading to leaking any information contained in     this request (including the credentials when sending a BIND request). (CVE-2018-1337)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Apache Directory LDAP API before 1.0.2, a bug in the way the SSL Filter was setup made it possible for
    another thread to use the connection before the TLS layer has been established, if the connection has
    already been used and put back in a pool of connections, leading to leaking any information contained in
    this request (including the credentials when sending a BIND request). (CVE-2018-1337)

ID	Name	Product	Family	Severity
326387	Linux Distros Unpatched Vulnerability : CVE-2018-1337	Nessus	Misc.	critical
421949	SCA: security update for org.apache.directory.api:apache-ldap-api (GHSA-cfw5-v7cw-69cw)	Tenable Cloud Security	SCA Checks	critical
421949	SCA: security update for org.apache.directory.api:apache-ldap-api (GHSA-cfw5-v7cw-69cw)	Tenable Self-Hosted Container Security	SCA Checks	critical

Detections

Analytics

CVE-2018-1337

critical

Tenable Plugins

critical

critical

critical