CVE-2023-28862

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a pa...

Original description

The description as published by the source.

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2023-28862 lemonldap-ng Fixed in: 2.0.11+ds-4+deb11u4

References

advisory github.com
advisory nvd.nist.gov
report gitlab.ow2.org
web gitlab.ow2.org
web lists.debian.org