Homepage
About Snyk

org.apache.druid.extensions:druid-basic-security@0.17.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.apache.druid.extensions:druid-basic-security package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • H
LDAP Injection

org.apache.druid.extensions:druid-basic-security is a basic security package for Apache Druid.

Affected versions of this package are vulnerable to LDAP Injection. When LDAP authentication is enabled in Apache Druid, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid.

How to fix LDAP Injection?

Upgrade org.apache.druid.extensions:druid-basic-security to version 0.17.1 or higher.

[0.17.0,0.17.1)
Go back to all versions of this package