Debian alert DLA-4734-1 (lemonldap-ng)

From:
             
 
Sylvain Beucler <beuc@beuc.net>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 4734-1] lemonldap-ng security update
Date:
             
 
Tue, 01 Sep 2026 15:15:39 +0200
Message-ID:
             
 
<apbP-0HZnoJLNAVO@mail.beuc.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4734-1               debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Xavier Guimard
August 12, 2026                              https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : lemonldap-ng
Version        : 2.0.11+ds-4+deb11u9 2.16.1+ds-deb12u9
CVE ID         : CVE-2026-12804 CVE-2026-19349

It was discovered that the Lemonldap::NG web SSO system insufficiently
enforced access when using the GitHub/Linkedin authentication backends.

CVE-2026-12804

      A vulnerability was detected in lemonldap-ng up to 2.0.0. Impacted
      is a function in the library
      lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of the
      component SAML Common Domain Cookie Endpoint. Performing a
      manipulation of the argument url results in open redirect.

CVE-2026-19349

      A vulnerability was detected in lemonldap-ng up to 2.0.3 through
      2.23.2, the GitHub and LinkedIn authentication backends store the
      OAuth2 state parameter using an obsolete positional call to
      getApacheSession(). The trailing arguments are silently misparsed
      as a named-argument hash, so the session kind defaults to SSO and
      the state is written to the global session storage as a regular
      SSO session. Because the state value is handed to the
      unauthenticated visitor in the redirection URL to the identity
      provider, a remote attacker can replay it as a lemonldap session
      cookie and obtain a valid SSO session without ever authenticating.
      Only configurations in which the GitHub or LinkedIn authentication
      module is enabled are affected.

For Debian 11 bullseye, these problems have been fixed in version
2.0.11+ds-4+deb11u9.

For Debian 12 bookworm, these problems have been fixed in version
2.16.1+ds-deb12u9.

We recommend that you upgrade your lemonldap-ng packages.

For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmqWzDAACgkQDTl9HeUl
XjDheA/+OFnsEp2f444Izh/eI40bT0i3xBBBjMyxB39JMKLlCS/8ZcUovQSUDnR6
CeT0zeH5zoAYeRWAmraOFyt334AvvPYPqyM3WakHNWevH85EjP0uct5c3YivjmBC
2BSuij56mpvuxLSMqTelqKsy9KmQ71MUJSwXVTCEe14QXy/hYGt/UJBacXUYlHSh
2AbWLa9qFewoLR1+mFAyxrHQSj2expeHKSf5QJrRt/FQ9usGdlYlMYYQ4Ym7wVhy
NKTmtnbsN0vvgx6Dt7ZrkxMqCMwr0Nast1440hhQRC8rfjXlc8EQI/Tay6bNWEqz
tz2iHA4aDTf2dvckhf0im2fGyqB8cs/otqLOukLz4uKoZ+shOAC8rXeXgANXNaMt
pzfbmbFsA5dxPKpT+h1CFtFQYL6pEleAKtsaklvoxWKcDuHx+WYNy54XZLLTWOFJ
N8ng59SzxWr2vp61ew+gqOKpNuTZJeHOQadi0Dsx7z+xtu9xJkAhlEsLPR6V7PoZ
3mfbsRUL4S19fXqN87p3oQ6UNtBu90mwGMSaFJuIkMQXIg+bfSSJkNPq/u6d9q0h
qrGVrg55l7HWNcipdlTfuCJlJ0i5HTgW84tvyx625vQLvHyd57rvYMiFYU0/RylB
wFMQ5xCn8j/t4uXyh+7/oOEOs0+3PWFRhnq7oJkxsaMvQVtP8Wg=
=/hYj
-----END PGP SIGNATURE-----