CVE-2017-11501: NixOS 17.03 and earlier has an unintended default absence of SSL Certificate Validation for LDAP.

Security readout for executives and security teams

On NixOS 17.03 and earlier, LDAP logins configured to use TLS could silently skip checking the LDAP server certificate. An attacker able to intercept that connection could potentially impersonate the LDAP server, undermining trust in authentication traffic. The sources do not provide CVSS scoring or evidence of active exploitation. Likely limited to NixOS 17.03 and earlier systems using the users.ldap module with users.ldap.useTLS for LDAP-backed user authentication. Prioritize review if LDAP backs privileged or broad employee access. The issue affects authentication trust, but evidence is limited and no active exploitation is cited. Mitigation focus: Identify affected NixOS 17.03 or earlier hosts using users.ldap.useTLS.; Review NixOS advisory and issue guidance before changing authentication settings.; Upgrade affected systems to a non-affected supported NixOS release where feasible..

Prepared

Jun 13, 2026, 04:25 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.