Debian: CVE-2021-35473: lemonldap-ng -- security update

Debian: CVE-2021-35473: lemonldap-ng -- security update

Severity

4

CVSS

(AV:L/AC:M/Au:N/C:P/I:P/A:P)

Published

07/30/2024

Created

07/31/2024

Added

07/30/2024

Modified

11/12/2024

Description

An issue was discovered in LemonLDAP::NG before 2.0.12. There is a missing expiration check in the OAuth2.0 handler, i.e., it does not verify access token validity. An attacker can use a expired access token from an OIDC client to access the OAuth2 handler The earliest affected version is 2.0.4.

Solution(s)

• debian-upgrade-lemonldap-ng

References

• https://attackerkb.com/topics/cve-2021-35473
• CVE - 2021-35473