-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| pgadmin4 | pip | <= 9.9 | 9.10 |
Miggo AIRoot Cause AnalysisThe analysis of the security patch 09d2b7eeb0e330df73b1aef0cba57788fde52b6b clearly indicates that the vulnerability CVE-2025-12765 is located in the web/pgadmin/authenticate/ldap.py file. The function Ldap.__configure_tls was responsible for configuring the TLS settings for the LDAP connection. The vulnerable code set the certificate validation mode to ssl.CERT_NONE by default, which means no certificate validation was performed unless specific certificate files were provided in the configuration. This created a scenario where TLS could be bypassed. The patch rectifies this by introducing a new configuration parameter, LDAP_CERT_VALIDATE, which defaults to True. This ensures that certificate validation (ssl.CERT_REQUIRED) is enabled by default, and must be explicitly disabled if needed, thus fixing the vulnerability.