Versions 2.2.4 and earlier of
ldapauth-fork are affected by an LDAP injection vulnerability. This allows an attacker to inject and run arbitrary LDAP commands via the username parameter.
ldapauth is not actively maintained, having not seen a publish since 2014. As a result, there is no patch available. Consider updating to use ldapauth-fork 2.3.3 or greater.
reportedInitial report by David Black, Jerome Touffe-BlinOct 17th, 2015
publishedAdvisory publishedSep 18th, 2015