Whilst reviewing the UIA Proxy for LDAP injection, I noticed that OpenLDAP uses SSHA for password hashing with SHA1 which is non-ideal. SHA-1 is fast to compute and should not be used for storing passwords, whilst it is salted it should still not be used and rather a secure password hashing algorithm should be used.
Problems that can arise:
Fast computation makes brute-forcing easier
SHA-1 is vulnerable to hash collisions
As we already plan on moving away from LDAP I don't think immediate action is worthwhile, this just should be documented and also considered in how important moving away from LDAP is.
Whilst reviewing the UIA Proxy for LDAP injection, I noticed that OpenLDAP uses SSHA for password hashing with SHA1 which is non-ideal. SHA-1 is fast to compute and should not be used for storing passwords, whilst it is salted it should still not be used and rather a secure password hashing algorithm should be used.
Problems that can arise:
As we already plan on moving away from LDAP I don't think immediate action is worthwhile, this just should be documented and also considered in how important moving away from LDAP is.