-------------------------------------------------------------------------Debian LTS Advisory DLA-3287-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                       Guilhem Moulin
January 28, 2023                              https://wiki.debian.org/LTS
-------------------------------------------------------------------------Package        : lemonldap-ng
Version        : 2.0.2+ds-7+deb10u8
CVE ID         : CVE-2020-16093 CVE-2022-37186

Two vulnerabilities were found in lemonldap-ng, an OpenID-Connect, CAS
and SAML compatible Web-SSO system, that could result in information
disclosure or impersonation.

CVE-2020-16093

    Maxime Besson discovered that LemonLDAP::NG before 2.0.9 did not
    check validity of the X.509 certificate by default when connecting
    to remote LDAP backends, because the default configuration of the
    Net::LDAPS module for Perl is used.

    This update changes the default behavior to require X.509 validation
    against the distribution bundle /etc/ssl/certs/ca-certificates.crt.
    Previous behavior can reverted by running
    `/usr/share/lemonldap-ng/bin/lemonldap-ng-cli set ldapVerify none`.

    If a session backend is set to Apache::Session::LDAP or
    Apache::Session::Browseable::LDAP, then the complete fix involves
    upgrading the corresponding Apache::Session module
    (libapache-session-ldap-perl resp. libapache-session-browseable-perl)
    to 0.4-1+deb10u1 (or ≥0.5) resp. 1.3.0-1+deb10u1 (or ≥1.3.8).  See
    related advisories DLA-3284-1 and DLA-3285-1 for details.

CVE-2022-37186

    Mickael Bride discovered that under certain conditions the session
    remained valid on handlers after being destroyed on portal.

For Debian 10 buster, these problems have been fixed in version
2.0.2+ds-7+deb10u8.

We recommend that you upgrade your lemonldap-ng packages.

For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/lemonldap-ng

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS