ADVISORIES

• CVE-2017-17718 (NVD)
• GHSA-m7p8-9w66-9frm
• Vendor Advisory

GEM

net-ldap

SEVERITY

CVSS v3.x: 5.9 (Medium)

PATCHED VERSIONS

• >= 0.16.0

DESCRIPTION

The Net::LDAP (aka net-ldap) gem before 0.16.0 for Ruby has Missing SSL Certificate Validation. The LDAP server's certificate was not verified to match the host it was supposed to be connecting to.

RELATED

• https://github.com/ruby-ldap/ruby-net-ldap/pull/279
• https://github.com/ruby-ldap/ruby-net-ldap/commit/e4c46a223a19feda78393a793711353aa1febdcd