[SECURITY] [DLA 4797-1] lemonldap-ng security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4797-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Xavier Guimard
September 26, 2026 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : lemonldap-ng
Version : 2.16.1+ds-deb12u10
CVE ID : CVE-2026-95811
Several vulnerabilities have been fixed in lemonldap-ng, a Web-SSO system.
CVE-2026-95811
Access rules (locationRules) were tested against the raw request URI
whereas web servers route on the decoded and normalized path. An
attacker could bypass some admin interface access rules using
percent-encoded characters or dot-segments in URLs (not the default
rule).
Additionally, the following issues have been fixed:
* Request parameters sent several times could inject arbitrary keys
in internal data structures (RESTProxy/SOAP data, spoofId,
templates).
* When checking access to another virtual host (menu, REST/SOAP
authorizationfor, CheckUser), the authentication level of the
current virtual host was used instead of the target one.
* With browsersDontStorePassword, passwords typed in portal forms
could be displayed in clear text.
For Debian 12 bookworm, these problems have been fixed in version
2.16.1+ds-deb12u10.
We recommend that you upgrade your lemonldap-ng packages.
For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQJEBAEBCgAuFiEEAN/li4tVV3nRAF7J9tdMp8mZ7ukFAmq30WkQHHlhZGRAZGVi
aWFuLm9yZwAKCRD210ynyZnu6UjCD/0aAaba59/ZYLV2531LuURG9VSxBVZfwWLi
rP+8FaePjL8Lm5ZRLA/bcuDNPl0mMu2EGm9dHK6WheLUYsXB3j19jzwHlCnvd/6G
K0b9o7z+CXTqPE4vlVnU/6pHQhlMVPhZuMSvq6YonOPsDq0JZ5cxI0fQOcwEjo1A
e38c2+iANQ1NVr21VM/8HT2t7HCijIAfGDK4nKMIKHQEwOFxmcmgCWkaboBEksjW
xgynWu3Wx7e45ZEmcBAuqcL0nUhudMzPPmR9pNQdumv/U/j5x/yGYuoVeXydt2Mi
ym8mGw/HzkOhjFVdJ2gNLS8yNGmFIeSxyi9t7yNSuNS/bHydwITRDrg1YDPcj9SF
bQ67JAO5x9e1ncOBqNVrLXqx1KtZhqYdmsFUvHdKTFfiSI+PlLO0OMXmumo0jiPp
2w/HZAGQflG+xrkPKU4BEd4SpvxgBqCXg+SYJwSUga4Q/Zi8Thw5L5X5M/Xg7mwv
N9CKcfOJaM1uaFvDO9iil1uKNDiI9YqIuErswb7lZxX4cg/Rc+iI4QtUWA2yYUu1
guru58or2O7yG9by2DvSZ6seagnvLgtmXydR5bCQYeM8/RLLiIbrp7GWO9tzrTcc
IAQ6/JNTcDhGuX38JZ8/kQ7wwpm7WnxY6/5Q6nuinfwG4Y8cEMh2inCKuUFk/46q
TNwVRbaoYg==
=KAGr
-----END PGP SIGNATURE-----
Reply to: