Netatalk LDAP Filter Injection Vulnerability

A vulnerability allowing LDAP filter injection has been identified in Netatalk versions 2.1.0 through 4.4.2. This issue arises because LDAP lookup filters can incorporate client-influenced name values without proper escaping. In deployments using LDAP for access control lists or identity mapping, this could lead to authorization or lookup errors.

Impact

Exploitation of this vulnerability could cause confusion in authorization or lookup processes, particularly in environments that rely on LDAP-backed access control or identity mapping.

Remediation

Users can upgrade to Netatalk version 4.5.0 or later, which includes the necessary patch. For those using Netatalk 4.4.2, the patch can be applied manually. The Netatalk team advises against applying the patch to existing deployments before upgrading, due to the low likelihood of practical exploitation.