Details

    • Type: Bug Bug
    • Status: Closed
    • Priority: Major Major
    • Resolution: Fixed
    • Affects Version/s: 1.3.4 (Beta), 1.3.6
    • Fix Version/s: 1.4.1
    • Component/s: Security, Web - Security
    • Labels:
      None

      Description

      Due to a bug in Redback (http://jira.codehaus.org/browse/REDBACK-248), there is a security problem with continuum if integrated with LDAP. When the user exists in the LDAP and you give an empty password you get access to continuum.
      I've created a patch for the redback issue and applied this to our continuum instance, and the problem was solved (see the redback issue for the patch. I've patched version 1.2.2 of redback-authentication-ldap as that's the version we are currently using (continuum 1.3.4). But I've checked if continuum 1.3.6 has the same bug and that's the case (however continuum 1.3.6 uses redback-authentication-ldap version 1.2.3).

      I hope the redback developers will integrate the patch. If not, continuum should check for empty password and fail before trying the LDAP authenticator.

        Activity

        Frederic created issue -
        Frederic made changes -
        Field Original Value New Value
        Link This issue depends upon REDBACK-248 [ REDBACK-248 ]
        Brett Porter made changes -
        Fix Version/s 1.4.1 (Beta) [ 15104 ]
        Hide
        Inaki added a comment -

        Tested version 1.3.7 with redback 1.2.6 and this is still happening!!!

        Show
        Inaki added a comment - Tested version 1.3.7 with redback 1.2.6 and this is still happening!!!
        Hide
        Maria Catherine Tan added a comment -

        REDBACK-248 is fixed in 1.3M1 which is what continuum trunk is using.

        Show
        Maria Catherine Tan added a comment - REDBACK-248 is fixed in 1.3M1 which is what continuum trunk is using.
        Maria Catherine Tan made changes -
        Resolution Fixed [ 1 ]
        Status Open [ 1 ] Closed [ 6 ]
        Mark Thomas made changes -
        Project Import Sun Apr 05 08:36:01 UTC 2015 [ 1428222961749 ]
        Mark Thomas made changes -
        Workflow jira [ 12711187 ] Default workflow, editable Closed status [ 12738556 ]
        Mark Thomas made changes -
        Project Import Sun Apr 05 21:12:18 UTC 2015 [ 1428268338676 ]
        Mark Thomas made changes -
        Workflow jira [ 12946253 ] Default workflow, editable Closed status [ 12984274 ]
        Transition Time In Source Status Execution Times Last Executer Last Execution Date
        Open Open Closed Closed
        380d 30m 1 Maria Catherine Tan 17/Jul/11 09:05

          People

          • Assignee:
            Unassigned
            Reporter:
            Frederic
          • Votes:
            1 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

            • Created:
              Updated:
              Resolved:

              Development