[SECURITY] [DLA 3287-1] lemonldap-ng security update

Debian LTS Advisory DLA-3287-1 [email protected]
https://www.debian.org/lts/security/ Guilhem Moulin
January 28, 2023 https://wiki.debian.org/LTS

Package : lemonldap-ng
Version : 2.0.2+ds-7+deb10u8
CVE ID : CVE-2020-16093 CVE-2022-37186

Two vulnerabilities were found in lemonldap-ng, an OpenID-Connect, CAS
and SAML compatible Web-SSO system, that could result in information
disclosure or impersonation.

CVE-2020-16093

Maxime Besson discovered that LemonLDAP::NG before 2.0.9 did not
check validity of the X.509 certificate by default when connecting
to remote LDAP backends, because the default configuration of the
Net::LDAPS module for Perl is used.

This update changes the default behavior to require X.509 validation
against the distribution bundle /etc/ssl/certs/ca-certificates.crt.
Previous behavior can reverted by running
`/usr/share/lemonldap-ng/bin/lemonldap-ng-cli set ldapVerify none`.

If a session backend is set to Apache::Session::LDAP or
Apache::Session::Browseable::LDAP, then the complete fix involves
upgrading the corresponding Apache::Session module
(libapache-session-ldap-perl resp. libapache-session-browseable-perl)
to 0.4-1+deb10u1 (or ≥0.5) resp. 1.3.0-1+deb10u1 (or ≥1.3.8).  See
related advisories DLA-3284-1 and DLA-3285-1 for details.

CVE-2022-37186

Mickael Bride discovered that under certain conditions the session
remained valid on handlers after being destroyed on portal.

For Debian 10 buster, these problems have been fixed in version
2.0.2+ds-7+deb10u8.

We recommend that you upgrade your lemonldap-ng packages.

For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature