Emmanuel Lécharny created DIRAPI-486:
----------------------------------------
Summary: GeneralizedTime accepts arbitrary trailing garbage after
fractional part
Key: DIRAPI-486
URL: https://issues.apache.org/jira/browse/DIRAPI-486
Project: Directory Client API
Issue Type: Bug
Affects Versions: 2.1.8
Reporter: Emmanuel Lécharny
Fix For: 2.1.9
An attacker-supplied *LDIF* entry (or attribute from a hostile server) carries
_pwdChangedTime_ of '_20991231235959.9UNTIL-FOREVER_'.
*OpenLDAP*/*389-ds* reject the value, but this parser accepts and canonicalizes
it, so a stack mixing this library with another *LDAP* implementation reaches
different conclusions about the same stored timestamp (account-expiry or
password-age checks pass here and fail there).
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
