CVE-2023-28862

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a pa...

原文の説明

取得元が公開している説明をそのまま載せています (多くは英語)。

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.

出典: OSV.dev (Open Source Vulnerabilities) NVD OSV

ディストリビューション別の修正状況

各ディストリビューションが公開している、この CVE の修正パッケージ

Debian DEBIAN-CVE-2023-28862 lemonldap-ng 修正版: 2.0.11+ds-4+deb11u4

参照URL

advisory github.com
advisory nvd.nist.gov
report gitlab.ow2.org
web gitlab.ow2.org
web lists.debian.org