CVE-2017-11501

https://notcve.org/view.php?id=CVE-2017-11501

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf. NixOS versión 17.03 y anteriores tienen una ausencia predeterminada involuntaria de la comprobación de certificado SSL para LDAP. El módulo users.ldap NixOS implementa la identificación de usuarios contra servidores LDAP por medio de un módulo PAM. • http://openwall.com/lists/oss-security/2017/07/20/1 https://github.com/NixOS/nixpkgs/issues/27506 https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk • CWE-295: Improper Certificate Validation •