Lucene search

K
debianDebianDEBIAN:DLA-3487-1:41733
HistoryJul 08, 2023 - 2:08 p.m.

[SECURITY] [DLA 3487-1] fusiondirectory security update and rebuild for php-cas

2023-07-0814:08:09
lists.debian.org
4
ldap
api change
fusiondirectory
session handling
cve-2022-36179
xss
security tracker
upgrade
php-cas
debian 10 buster
cve-2022-36180

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%


Debian LTS Advisory DLA-3487-1 [email protected]
https://www.debian.org/lts/security/ Abhijith PA
Tobias Frost
July 08, 2023 https://wiki.debian.org/LTS

Package : fusiondirectory
Version : 1.2.3-4+deb10u2
CVE ID : CVE-2022-36179 CVE-2022-36180
Debian Bug :

A potential Cross Site Scripting (XSS) vulnerablity (CVE-2022-36180) and
session handling vulnerability (CVE-2022-36179 )have been found in
fusiondirectory, a Web Based LDAP Administration Program.

Additionally, fusiondirectory has been updated to address the API change
in php-cas due to CVE-2022-39369, see DLA 3485-1 for details.

Due to this, if CAS authentication is used, fusiondirectory
will stop working until those steps are done:

  • make sure to install the updated fusiondirectory-schema package for
    buster.

  • update the fusiondirectory core schema in LDAP by running
    fusiondirectory-insert-schema -m

  • switch to using the new php-cas API by running
    fusiondirectory-setup --set-config-CasLibraryBool=TRUE

  • set the CAS ClientServiceName to the base URL of the fusiondirectory
    installation, for example:
    fusiondirectory-setup --set-config-CasClientServiceName="https://fusiondirectory.example.org/"

For Debian 10 buster, these problems have been fixed in version
1.2.3-4+deb10u2.

We recommend that you upgrade your fusiondirectory packages.

For the detailed security status of fusiondirectory please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/fusiondirectory

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

8.7 High

AI Score

Confidence

High

0.003 Low

EPSS

Percentile

66.3%