DLA 3287-1: lemonldap-ng security update
-------------------------------------------------------------------------
Debian LTS Advisory DLA-3287-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Guilhem Moulin
January 28, 2023 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : lemonldap-ng
Version : 2.0.2+ds-7+deb10u8
CVE ID : CVE-2020-16093 CVE-2022-37186
Two vulnerabilities were found in lemonldap-ng, an OpenID-Connect, CAS
and SAML compatible Web-SSO system, that could result in information
disclosure or impersonation.
CVE-2020-16093
Maxime Besson discovered that LemonLDAP::NG before 2.0.9 did not
check validity of the X.509 certificate by default when connecting
to remote LDAP backends, because the default configuration of the
Net::LDAPS module for Perl is used.
This update changes the default behavior to require X.509 validation
against the distribution bundle /etc/ssl/certs/ca-certificates.crt.
Previous behavior can reverted by running
`/usr/share/lemonldap-ng/bin/lemonldap-ng-cli set ldapVerify none`.
If a session backend is set to Apache::Session::LDAP or
Apache::Session::Browseable::LDAP, then the complete fix involves
upgrading the corresponding Apache::Session module
(libapache-session-ldap-perl resp. libapache-session-browseable-perl)
to 0.4-1+deb10u1 (or ≥0.5) resp. 1.3.0-1+deb10u1 (or ≥1.3.8). See
related advisories DLA-3284-1 and DLA-3285-1 for details.
CVE-2022-37186
Mickael Bride discovered that under certain conditions the session
remained valid on handlers after being destroyed on portal.
For Debian 10 buster, these problems have been fixed in version
2.0.2+ds-7+deb10u8.
We recommend that you upgrade your lemonldap-ng packages.
For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
A lemonldap-ng security update has been released for Debian GNU/Linux 10 LTS to address two vulnerabilities that could result in information disclosure or impersonation.
