Rebind with empty password could lead to a potential security issue

[dmanchon]

Problem: Rebind is comparing making this comparison to validate input data:

if password:
    self.password = password

That condition is false in case of password = '', so the old value of the object will be keep in that case, including case where the bind was correct.

This is a potential security hole, since a correct bind followed by a rebind with empty password will complete the binding correctly.

I have changed the way the password is checked to only check if None.
#392

[cannatag]

Thanks, will include your fix in the next release of ldap3.

[dmanchon]

Thanks a lot @cannatag

[cannatag]

Fixed in v2.4