CVE-2020-1958: Information Exposure

April 1, 2020 (updated July 21, 2021)

When LDAP authentication is enabled in Apache Druid, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter barrier that determines if a valid LDAP user is allowed to authenticate with Druid.

References

nvd.nist.gov/vuln/detail/CVE-2020-1958

Code Behaviors & Features

Detect and mitigate CVE-2020-1958 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →