Xavier, did you sign it? "Only messages signed by a Debian developer will be accepted by this list."
Thanks! El 12/08/26 a las 22:05, Xavier escribió: > I don't see my message in > https://lists.debian.org/debian-lts-announce/2026/08/threads.html, was it > blocked ? > > Le 12/08/2026 à 21:45, Xavier a écrit : > > Hi, > > > > yes, I was waiting for DSA to be released. I just pushed the DLA > > > > Best regards, > > Xavier > > > > Le 12/08/2026 à 20:22, Santiago Ruano Rincón a écrit : > > > Hello, Xavier > > > > > > And thanks for preparing the lemonldap-ng updates for both bookworm and > > > bullseye. Unless I'm wrong, I don't see any DLA yet. Are you planning > > > to send it, or do you want some help to handle the paperwork? > > > > > > El 11/08/26 a las 10:20, Debian FTP Masters escribió: > > > > -----BEGIN PGP SIGNED MESSAGE----- > > > > Hash: SHA512 > > > > > > > > Format: 1.8 > > > > Date: Tue, 11 Aug 2026 11:01:31 +0200 > > > > Source: lemonldap-ng > > > > Binary: lemonldap-ng lemonldap-ng-doc > > > > lemonldap-ng-fastcgi-server lemonldap-ng-handler > > > > lemonldap-ng-uwsgi-app liblemonldap-ng-common- perl > > > > liblemonldap-ng-handler-perl liblemonldap-ng-manager-perl > > > > liblemonldap-ng-portal-perl > > > > liblemonldap-ng-ssoaas-apache-client-perl > > > > Architecture: source all > > > > Version: 2.16.1+ds-deb12u9 > > > > Distribution: bookworm-security > > > > Urgency: medium > > > > Maintainer: Debian Perl Group <pkg-perl- > > > > [email protected]> > > > > Changed-By: Xavier Guimard <[email protected]> > > > > Description: > > > > lemonldap-ng - OpenID-Connect, CAS and SAML compatible Web-SSO system > > > > lemonldap-ng-doc - Lemonldap::NG Web-SSO system documentation > > > > lemonldap-ng-fastcgi-server - Lemonldap::NG FastCGI server > > > > lemonldap-ng-handler - Lemonldap::NG handler part > > > > lemonldap-ng-uwsgi-app - Lemonldap::NG uWSGI server > > > > liblemonldap-ng-common-perl - Lemonldap::NG common files > > > > liblemonldap-ng-handler-perl - Lemonldap::NG handler common libraries > > > > liblemonldap-ng-manager-perl - Lemonldap::NG manager part > > > > liblemonldap-ng-portal-perl - Lemonldap::NG authentication portal part > > > > liblemonldap-ng-ssoaas-apache-client-perl - Lemonldap::NG > > > > SSOaaS client for Apache > > > > Changes: > > > > lemonldap-ng (2.16.1+ds-deb12u9) bookworm-security; urgency=medium > > > > . > > > > * Improve CDC filtering (Closes: CVE-2026-12804) > > > > * Use OTP to store GitHub/LinkedIn states (Closes: CVE-2026-19349) > > > > > > > > > [snip] > > > > > > Cheers, > > > > > > -- Santiago > > > Date: Wed, 12 Aug 2026 21:44:15 +0200 > From: Xavier <[email protected]> > To: [email protected] > Subject: [SECURITY] [DLA 4734-1] lemonldap-ng security update > Message-ID: <[email protected]> > > ------------------------------------------------------------------------- > Debian LTS Advisory DLA-4734-1 [email protected] > https://www.debian.org/lts/security/ Xavier Guimard > August 12, 2026 https://wiki.debian.org/LTS > ------------------------------------------------------------------------- > > Package : lemonldap-ng > Version : 2.0.11+ds-4+deb11u9 2.16.1+ds-deb12u9 > CVE ID : CVE-2026-12804 CVE-2026-19349 > Debian Bug : > > Brief introduction > > CVE-2026-12804 > > A vulnerability was detected in lemonldap-ng up to 2.0.0. Impacted > is a function in the library > lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of the > component SAML Common Domain Cookie Endpoint. Performing a > manipulation of the argument url results in open redirect. > > CVE-2026-19349 > > A vulnerability was detected in lemonldap-ng up to 2.0.3 through > 2.23.2, the GitHub and LinkedIn authentication backends store the > OAuth2 state parameter using an obsolete positional call to > getApacheSession(). The trailing arguments are silently misparsed > as a named-argument hash, so the session kind defaults to SSO and > the state is written to the global session storage as a regular > SSO session. Because the state value is handed to the > unauthenticated visitor in the redirection URL to the identity > provider, a remote attacker can replay it as a lemonldap session > cookie and obtain a valid SSO session without ever authenticating. > Only configurations in which the GitHub or LinkedIn authentication > module is enabled are affected. > > For Debian 11 bullseye, these problems have been fixed in version > 2.0.11+ds-4+deb11u9. > > For Debian 12 bookworm, these problems have been fixed in version > 2.16.1+ds-deb12u9. > > We recommend that you upgrade your lemonldap-ng packages. > > For the detailed security status of lemonldap-ng please refer to > its security tracker page at: > https://security-tracker.debian.org/tracker/lemonldap-ng > > Further information about Debian LTS security advisories, how to apply > these updates to your system and frequently asked questions can be > found at: https://wiki.debian.org/LTS >
