CVE-2020-1958: 
Java vulnerability analysis and mitigation

CVE-2020-1958 is a security vulnerability discovered in Apache Druid version 0.17.0 affecting its LDAP authentication mechanism. The vulnerability was disclosed on April 1, 2020, and allows users with valid LDAP credentials to bypass the credentialsValidator.userSearch filter barrier (NVD).

The vulnerability has a CVSS v3.1 Base Score of 6.5 (MEDIUM) with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. It is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component). While authenticated users can bypass the credentialsValidator.userSearch filter, they remain subject to role-based authorization checks if configured (NVD).

The vulnerability allows authenticated users to bypass certain LDAP authentication controls and enables unauthorized access to LDAP attribute values of users on the LDAP server, as long as that information is visible to the Druid server. Notably, this information disclosure does not require the caller to be a valid LDAP user (NVD).

The vulnerability affects Apache Druid version 0.17.0. Users should upgrade to a patched version of the software. The fix was implemented through pull request #9600 and backported to affected versions (Apache Lists).