You are viewing a plain text version of this content. The canonical link for it is here.

Posted to dev@directory.apache.org by "Emmanuel Lécharny (Jira)" <ji...@apache.org> on 2026/09/28 13:38:00 UTC

[jira] [Closed] (DIRAPI-446) StartTLS transition accepts plaintext LDAP PDUs injected before handshake

     [ https://issues.apache.org/jira/browse/DIRAPI-446?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Emmanuel Lécharny closed DIRAPI-446.
------------------------------------

> StartTLS transition accepts plaintext LDAP PDUs injected before handshake
> -------------------------------------------------------------------------
>
>                 Key: DIRAPI-446
>                 URL: https://issues.apache.org/jira/browse/DIRAPI-446
>             Project: Directory Client API
>          Issue Type: Bug
>    Affects Versions: 2.1.8
>            Reporter: Emmanuel Lécharny
>            Priority: Major
>             Fix For: 2.1.9
>
>
> The application starts an _async search (messageId N)_ then calls _startTls()_.
> The *MITM* forwards the genuine *StartTLS* success response and appends plaintext _SearchResultEntry/Done_ *PDUs* with _messageId_ N.
> *MINA* runs the whole segment through the pre-TLS chain before the _SslFilter_ is installed, and the application consumes forged entries 'over TLS'.



--
This message was sent by Atlassian Jira
(v8.20.10#820010)

---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@directory.apache.org
For additional commands, e-mail: dev-help@directory.apache.org