Total vulnerabilities in the database
The cherokee_validator_ldap_check function in validator_ldap.c in Cherokee 1.2.103 and earlier, when LDAP is used, does not properly consider unauthenticated-bind semantics, which allows remote attackers to bypass authentication via an empty password.
| Software | From | Fixed in |
|---|---|---|
| fedoraproject / fedora | 22 | 22.x |
| fedoraproject / fedora | 20 | 20.x |
| fedoraproject / fedora | 21 | 21.x |
| mageia_project / mageia | 4 | 4.x |
| cherokee-project / cherokee | 1.2.99 | 1.2.99.x |
| cherokee-project / cherokee | 1.2.2 | 1.2.2.x |
| cherokee-project / cherokee | - | 1.2.103.x |
| cherokee-project / cherokee | 1.2.101 | 1.2.101.x |
| cherokee-project / cherokee | 1.2.98 | 1.2.98.x |
| cherokee-project / cherokee | 1.2.102 | 1.2.102.x |