LDAP DataConnecter attribute resolver cache collision

Cantor, Scott cantor.2 at osu.edu
Thu Oct 27 14:34:46 EDT 2016


And for the record, what we would have done in assessing the bug and the impact would be to immediately issue a security advisory, probably within a day, informing people to disable the LDAP result cache, and get it patched in the release due in weeks. And possibly issue a 3.2.2 patch but I doubt it because of the timing and the workaround.

I don't believe the SQL connector is similarly afflicted, it's keying the cache with the whole statement and we don't support parameterized queries.

-- Scott



More information about the dev mailing list