The vulnerability scanner database has a vulnerability entry for net_ldap < 0.60, the salt value used for passwords seems to be too weak [1].
There's a patch available with net_ldap >= 0.60 but devise_ldap_authenticatable seems to currently support net_ldap < 0.60. Are there any plans to upgrade the net_ldap version?
The vulnerability scanner database has a vulnerability entry for
net_ldap < 0.60
, the salt value used for passwords seems to be too weak [1].There's a patch available with
net_ldap >= 0.60
butdevise_ldap_authenticatable
seems to currently supportnet_ldap < 0.60
. Are there any plans to upgrade the net_ldap version?[1] https://github.com/rubysec/ruby-advisory-db/blob/master/gems/net-ldap/OSVDB-106108.yml
Thanks, Tobi