Of course I signed it, see attachment
Le 12/08/2026 à 22:30, Santiago Ruano Rincón a écrit :
Xavier, did you sign it?
"Only messages signed by a Debian developer will be accepted by this
list."
Thanks!
El 12/08/26 a las 22:05, Xavier escribió:
I don't see my message in
https://lists.debian.org/debian-lts-announce/2026/08/threads.html, was it
blocked ?
Le 12/08/2026 à 21:45, Xavier a écrit :
Hi,
yes, I was waiting for DSA to be released. I just pushed the DLA
Best regards,
Xavier
Le 12/08/2026 à 20:22, Santiago Ruano Rincón a écrit :
Hello, Xavier
And thanks for preparing the lemonldap-ng updates for both bookworm and
bullseye. Unless I'm wrong, I don't see any DLA yet. Are you planning
to send it, or do you want some help to handle the paperwork?
El 11/08/26 a las 10:20, Debian FTP Masters escribió:
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Tue, 11 Aug 2026 11:01:31 +0200
Source: lemonldap-ng
Binary: lemonldap-ng lemonldap-ng-doc
lemonldap-ng-fastcgi-server lemonldap-ng-handler
lemonldap-ng-uwsgi-app liblemonldap-ng-common- perl
liblemonldap-ng-handler-perl liblemonldap-ng-manager-perl
liblemonldap-ng-portal-perl
liblemonldap-ng-ssoaas-apache-client-perl
Architecture: source all
Version: 2.16.1+ds-deb12u9
Distribution: bookworm-security
Urgency: medium
Maintainer: Debian Perl Group <pkg-perl-
[email protected]>
Changed-By: Xavier Guimard <[email protected]>
Description:
lemonldap-ng - OpenID-Connect, CAS and SAML compatible Web-SSO system
lemonldap-ng-doc - Lemonldap::NG Web-SSO system documentation
lemonldap-ng-fastcgi-server - Lemonldap::NG FastCGI server
lemonldap-ng-handler - Lemonldap::NG handler part
lemonldap-ng-uwsgi-app - Lemonldap::NG uWSGI server
liblemonldap-ng-common-perl - Lemonldap::NG common files
liblemonldap-ng-handler-perl - Lemonldap::NG handler common libraries
liblemonldap-ng-manager-perl - Lemonldap::NG manager part
liblemonldap-ng-portal-perl - Lemonldap::NG authentication portal part
liblemonldap-ng-ssoaas-apache-client-perl - Lemonldap::NG
SSOaaS client for Apache
Changes:
lemonldap-ng (2.16.1+ds-deb12u9) bookworm-security; urgency=medium
.
* Improve CDC filtering (Closes: CVE-2026-12804)
* Use OTP to store GitHub/LinkedIn states (Closes: CVE-2026-19349)
[snip]
Cheers,
-- Santiago
Date: Wed, 12 Aug 2026 21:44:15 +0200
From: Xavier <[email protected]>
To: [email protected]
Subject: [SECURITY] [DLA 4734-1] lemonldap-ng security update
Message-ID: <[email protected]>
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4734-1 [email protected]
https://www.debian.org/lts/security/ Xavier Guimard
August 12, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : lemonldap-ng
Version : 2.0.11+ds-4+deb11u9 2.16.1+ds-deb12u9
CVE ID : CVE-2026-12804 CVE-2026-19349
Debian Bug :
Brief introduction
CVE-2026-12804
A vulnerability was detected in lemonldap-ng up to 2.0.0. Impacted
is a function in the library
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of the
component SAML Common Domain Cookie Endpoint. Performing a
manipulation of the argument url results in open redirect.
CVE-2026-19349
A vulnerability was detected in lemonldap-ng up to 2.0.3 through
2.23.2, the GitHub and LinkedIn authentication backends store the
OAuth2 state parameter using an obsolete positional call to
getApacheSession(). The trailing arguments are silently misparsed
as a named-argument hash, so the session kind defaults to SSO and
the state is written to the global session storage as a regular
SSO session. Because the state value is handed to the
unauthenticated visitor in the redirection URL to the identity
provider, a remote attacker can replay it as a lemonldap session
cookie and obtain a valid SSO session without ever authenticating.
Only configurations in which the GitHub or LinkedIn authentication
module is enabled are affected.
For Debian 11 bullseye, these problems have been fixed in version
2.0.11+ds-4+deb11u9.
For Debian 12 bookworm, these problems have been fixed in version
2.16.1+ds-deb12u9.
We recommend that you upgrade your lemonldap-ng packages.
For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
--- Begin Message ---
-------------------------------------------------------------------------
Debian LTS Advisory DLA-4734-1 [email protected]
https://www.debian.org/lts/security/ Xavier Guimard
August 12, 2026 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : lemonldap-ng
Version : 2.0.11+ds-4+deb11u9 2.16.1+ds-deb12u9
CVE ID : CVE-2026-12804 CVE-2026-19349
Debian Bug :
Brief introduction
CVE-2026-12804
A vulnerability was detected in lemonldap-ng up to 2.0.0. Impacted
is a function in the library
lemonldap-ng-portal/lib/Lemonldap/NG/Portal/CDC.pm of the
component SAML Common Domain Cookie Endpoint. Performing a
manipulation of the argument url results in open redirect.
CVE-2026-19349
A vulnerability was detected in lemonldap-ng up to 2.0.3 through
2.23.2, the GitHub and LinkedIn authentication backends store the
OAuth2 state parameter using an obsolete positional call to
getApacheSession(). The trailing arguments are silently misparsed
as a named-argument hash, so the session kind defaults to SSO and
the state is written to the global session storage as a regular
SSO session. Because the state value is handed to the
unauthenticated visitor in the redirection URL to the identity
provider, a remote attacker can replay it as a lemonldap session
cookie and obtain a valid SSO session without ever authenticating.
Only configurations in which the GitHub or LinkedIn authentication
module is enabled are affected.
For Debian 11 bullseye, these problems have been fixed in version
2.0.11+ds-4+deb11u9.
For Debian 12 bookworm, these problems have been fixed in version
2.16.1+ds-deb12u9.
We recommend that you upgrade your lemonldap-ng packages.
For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
OpenPGP_0x6ACEDAAE40DD2B46.asc
Description: OpenPGP public key
OpenPGP_signature.asc
Description: OpenPGP digital signature
--- End Message ---
