Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

pingidentity/ldapsdk

              master @ cab6672
            

Fixes

CVEs

CRITICAL

Peak severity

0.0%

Coverage

Highlights

Auth Bypass: 1 prior fix. Scrutinize any change in this area.

src/com/unboundid/ldap/sdk/GSSAPIBindRequest.java: most-fixed (1 issue). Treat as high-risk during review.

1 high-severity fix in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Auth Bypass: Duplicating a GSSAPI bind request dropped non-default channel binding configurations (such as TLS server endpoints), weakening defense against credential and connection relaying attacks. Developers must verify that request duplication or replication routines always deep-copy all connection security bindings.

Deserialization of Untrusted Data: The persistence framework used default Java serialization, enabling arbitrary code execution through malicious payloads. This was mitigated by introducing look-ahead class whitelisting within a custom ObjectInputStream. Similar deserialization paths must enforce strict class validation.

Auth Bypass: A missing empty password check allowed remote attackers to bypass authentication entirely and impersonate valid users when processing simple bind requests. All custom credential validation logic must explicitly reject empty passwords under unauthenticated bind states.