Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
cannatag/ldap3
dev @ c5be4b6
11
Fixes
0
CVEs
HIGH
Peak severity
25.0%
Coverage
Highlights
Auth Bypass: 5 prior fixes. Scrutinize any change in this area.
ldap3/core/connection.py: most-fixed (4 issues). Treat as high-risk during review.
4 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: The client failed to verify that StartTLS negotiation actually completed successfully before executing subsequent bind requests, resulting in potential transmission of credentials in cleartext or unauthorized access. Rebinding on connections where session security was already established was also inadequately restricted.
Cleartext Transmission of Sensitive Information: During failover from an LDAPS server to a StartTLS server in a pool, the restartable strategy would silently drop TLS encryption, transmitting subsequent LDAP operations in cleartext. Under the same strategy, a backwards boolean check allowed failed StartTLS negotiations to be entirely ignored.
Denial of Service: Type checking and exception handling were missing when parsing Active Directory timestamps and deltatimes, allowing malformed or unexpected responses from LDAP servers to trigger TypeErrors and crash the client.