[SECURITY] [DSA 6520-1] lemonldap-ng security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-6520-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
September 27, 2026 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : lemonldap-ng
CVE ID : CVE-2026-92288 CVE-2026-92289 CVE-2026-95811
Multiple security vulnerabilities were discovered in the Lemonldap::NG
web SSO system, which could result in a bypass of access controls,
authorisation bypass in setups using PKCE or information disclosure.
For the stable distribution (trixie), these problems have been fixed in
version 2.21.2+ds-1+deb13u4.
We recommend that you upgrade your lemonldap-ng packages.
For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmq5UQAACgkQEMKTtsN8
TjYnFw/+JTTNzpxK8yzhLvlur8+ncw4Ril4QjZetdhwpDDoO4xlswERRe5qZUvXB
ounAegJSYSZpiYfGuZm5P/RuY5g5WupSJB5rBn/DtPZzSUdcrBm2GdqPGr7iNLwY
aYmUmZj0THuro/XVLAEtgPPDfJKvdXYXgiSskaNmCoSRn5RwFcQGk8bthKKhHvK6
MssYCcltVB98hglhgLN0DYlqwGJMuLZFalzlG1RbU7iR5UC367OAd/chcMiddEM4
ZJ+1ihVEOYtoEXNPe6q/Bscn09BO8pjZlxpwt9vVYxSyzQf30h7NuKwNb9E+WcEq
XwW3paEl6ABNu3KbuqaFcqHphru3NXOElbnQMSUlYL/BoQkzYbh+++iGmd3p+78W
RAsN7nKBQDMSmfolsa/7PFKa3hLzF9q20QQOgnhNFazP/ASE91Lkf/zg36jgU4fR
wcm0k3q7iNVuMAdGr38Wya9FjhlXM4JGFdC/LDp6V2TbjsLp5cX5RvU/KHC1cuZl
uh5FJOJFpJS+9l+7ECfF4igdMGRqS8nCxP9bJ7X3xKZKSHVHUXFW3TipFPTAkcL2
o4gLMqh+Du7vpG8zhngWcowkUYIa3Vz+1+44yCO5bvt7b98CxwKwEvNYSYAf2Mqr
Jz0V8kcyH6972Wk//aScxPZxD9ZyowZGXCEqtKWyP3bf9rR5MSw=
=QVxB
-----END PGP SIGNATURE-----
Reply to: