Maven/org.apereo.cas:cas-server-support-x509-core CVE-2023-28857: medium 4
Apereo CAS vulnerable to credential leaks for LDAP authentication
Action: Upgrade org.apereo.cas:cas-server-support-x509-core to 6.6.6 or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 6.5.0 | 6.6.6 | - |
Fixed versions
| 6.6.6 |
Sources
- osv: GHSA-p78h-m8pv-g9gm
- https://nvd.nist.gov/vuln/detail/CVE-2023-28857
- https://apereo.github.io/2023/02/20/x509-vuln
- https://github.com/apereo/cas
- https://github.com/apereo/cas/releases/tag/v6.6.6
- https://github.com/graciantrivino/cas/blob/b90003f43a8ac0382d5416ceb01074feb936bf24/cas-server-support-x509/src/main/java/org/jasig/cas/adaptors/x509/authentication/handler/support/X509CredentialsAuthenticationHandler.java#L231
- https://securitylab.github.com/advisories
- https://securitylab.github.com/advisories/GHSL-2023-009_Apereo_CAS
CVE-2023-28857 · published · modified · JSON