CVE-2017-11501

· N/AModified

← All CVEs

CVSS v3.1

N/A

EPSS

0.88%

Published

Jul 20, 2017

Modified

May 12, 2026

Public PoC / Exploit

All weaponized →

No public PoC or exploit code indexed for this CVE.

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP. The users.ldap NixOS module implements user authentication against LDAP servers via a PAM module. It was found that if TLS is enabled to connect to the LDAP server with users.ldap.useTLS, peer verification will be unconditionally disabled in /etc/ldap.conf.

Weaknesses (CWE)

CWE-295

Affected Products (1)

nixos_project · nixosvulnerable

References (6)

http://openwall.com/lists/oss-security/2017/07/20/1

Mailing ListMitigationPatch

https://github.com/NixOS/nixpkgs/issues/27506

Issue TrackingThird Party Advisory

https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk

http://openwall.com/lists/oss-security/2017/07/20/1

Mailing ListMitigationPatch

https://github.com/NixOS/nixpkgs/issues/27506

Issue TrackingThird Party Advisory

https://groups.google.com/forum/#%21topic/nix-security-announce/qrDU0KH_ZRk

KEV Catalog EPSS Scores Vendors All CVEs