CVE-2022-37397
The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
概要
The software is vulnerable when using LDAP-based authentication in YCQL with Microsoft’s Active Directory
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in the YugabyteDB 2.6.1 when using LDAP-based authentication in YCQL with Microsoft’s Active Directory. When anonymous or unauthenticated LDAP binding is enabled, it allows bypass of authentication with an empty password.
参照URL
- advisory github.com
- advisory nvd.nist.gov
- web yugabyte.com