[
https://issues.apache.org/jira/browse/KARAF-4892?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=15741872#comment-15741872
]
ASF subversion and git services commented on KARAF-4892:
--------------------------------------------------------
Commit ac07cb2440ceff94b3001728c1611fc471253d19 in karaf's branch
refs/heads/master from [~jbonofre]
[ https://git-wip-us.apache.org/repos/asf?p=karaf.git;h=ac07cb2 ]
[KARAF-4892] Encode user to avoid LDAP injection
> Encode username in LDAPLoginModule to avoid "code" injection
> ------------------------------------------------------------
>
> Key: KARAF-4892
> URL: https://issues.apache.org/jira/browse/KARAF-4892
> Project: Karaf
> Issue Type: Bug
> Components: karaf-security
> Reporter: Jean-Baptiste Onofré
> Assignee: Jean-Baptiste Onofré
> Fix For: 4.1.0, 4.0.8
>
>
> A malicious user can inject "LDAP" code in the username, causing bad behavior
> in the LDAP login module.
> To prevent this, the LDAP login module should encode the user.
--
This message was sent by Atlassian JIRA
(v6.3.4#6332)
