CVE-2023-28862

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a pa...

Description d'origine

La description telle que publiée par la source (souvent en anglais).

An issue was discovered in LemonLDAP::NG before 2.16.1. Weak session ID generation in the AuthBasic handler and incorrect failure handling during a password check allow attackers to bypass 2FA verification. Any plugin that tries to deny session creation after the store step does not deny an AuthBasic session.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

État des correctifs par distribution

Paquets corrigés publiés par chaque distribution pour cette CVE

Debian DEBIAN-CVE-2023-28862 lemonldap-ng Corrigé dans: 2.0.11+ds-4+deb11u4

Références

advisory github.com
advisory nvd.nist.gov
report gitlab.ow2.org
web gitlab.ow2.org
web lists.debian.org