CVE-2020-36658 Information

Description

In Apache::Session::LDAP before 0.5 validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can for example be fixed in conjunction with the CVE-2020-16093 fix.

Reference

https://github.com/LemonLDAPNG/Apache-Session-LDAP/commit/490722b71eed1ed1ab33d58c78578f23e043561f