What’s Vulnerable › Vulnerabilities

CVE-2014-0083: net-ldap has weak salt when generating passwords

• Severity: medium (CVSS 5.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2019-11-21 · updated 2026-06-17
• Weakness: CWE-916

Description

The Ruby net-ldap gem before 0.11 uses a weak salt when generating SSHA passwords.

Affected products

• Debian Linux: 8.0, 9.0, 10.0
• Net-Ldap Project Net-Ldap: before 0.16.2 — fixed in 0.16.2
• Rubygems Net-Ldap: before 0.16.2; 0.0.5, 0.1.0, 0.1.1, 0.10.0, 0.10.1, 0.11 (+18) — fixed in 0.16.2

How to fix

Upgrade to a fixed version: Net-Ldap Project Net-Ldap 0.16.2; Rubygems Net-Ldap 0.16.2. Check the vendor advisory for mitigations.

References

• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0083
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0083
• https://github.com/ruby-ldap/ruby-net-ldap/commit/b412ca05f6b430eaa1ce97ac95885b4cf187b04a
• https://security-tracker.debian.org/tracker/CVE-2014-0083
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-0083
• https://bugzilla.suse.com/show_bug.cgi?id=CVE-2014-0083
• https://github.com/ruby-ldap/ruby-net-ldap/commit/b412ca05f6b430eaa1ce97ac95885b4cf187b04a
• https://security-tracker.debian.org/tracker/CVE-2014-0083

Get alerted when CVE-2014-0083 or the next vulnerability affects your stack