CVE-2017-11501

Severity: medium (CVSS 5.9 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.9% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-07-20 · updated 2026-06-17
Weakness: CWE-295

Description

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf.

Affected products

Nixos Project Nixos: through 17.03

References

http://openwall.com/lists/oss-security/2017/07/20/1
https://github.com/NixOS/nixpkgs/issues/27506
https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk
http://openwall.com/lists/oss-security/2017/07/20/1
https://github.com/NixOS/nixpkgs/issues/27506
https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk

Get alerted when CVE-2017-11501 or the next vulnerability affects your stack