CVE-2025-59518
In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rul...
Original description
The description as published by the source.
In LemonLDAP::NG before 2.16.7 and 2.17 through 2.21 before 2.21.3, OS command injection can occur in the Safe jail. It does not Localize _ during rule evaluation. Thus, an administrator who can edit a rule evaluated by the Safe jail can execute commands on the server.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-59518 lemonldap-ng Fixed in: 2.0.11+ds-4+deb11u8
- Ubuntu UBUNTU-CVE-2025-59518 lemonldap-ng
References
- advisory github.com
- advisory nvd.nist.gov
- patch gitlab.ow2.org
- report gitlab.ow2.org