[SECURITY] [DLA 3497-1] pypdf2 security update

2023-07-14 Thread Adrian Bunk 
-BEGIN PGP SIGNED MESSAGE-
Hash: SHA512

- -
Debian LTS Advisory DLA-3497-1debian-...@lists.debian.org
https://www.debian.org/lts/security/  Adrian Bunk
July 14, 2023 https://wiki.debian.org/LTS
- -

Package: pypdf2
Version: 1.26.0-2+deb10u2
CVE ID : CVE-2023-36810

Quadratic runtime with malformed PDFs missing xref marker has been fixed 
in PyPDF2, a pure Python PDF library.

For Debian 10 buster, this problem has been fixed in version
1.26.0-2+deb10u2.

We recommend that you upgrade your pypdf2 packages.

For the detailed security status of pypdf2 please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/pypdf2

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-BEGIN PGP SIGNATURE-

iQIzBAEBCgAdFiEEOvp1f6xuoR0v9F3wiNJCh6LYmLEFAmSxthkACgkQiNJCh6LY
mLFjvRAApnyrNsqRi2+tFb1HJgqgMj8nmFk+HFleyWTZjP/z6iR1h917B/vQnHz1
byT+IYMknVhXKduf+mOiYItWE5tNGpXMwZtgX3yXnnvYLNcKR/SuN900vWx3OSf/
fIbe2hLJtHuo9CEopv6GxFo4k2aZFD5dqRxXPeyq1BGHL0/T6b6PiZ6bLGIkATiq
ZWcWOMWZuaMX/t1wrJs0EC5LlgbowKs2acvxUsjcKYqX+SyDxHgdSgRvmnCfHlIu
dnW1HtqxozRjgx7uMtCvh6yYsVHr3rozSrS4hODiYmxSJnoe5uSILL7bFni3wWYK
YE13xtlZrVemqEZ1PHojZ3oZ4KSSW2jaBkc06ybI1C6LGoJwmYiJuC6RqaceVtaQ
ZyHWm4d6T8OozEIL48pmHsM+05/DQOcaaTEnJlLQH8d+xELYdd75ZYSJUkDIUPbc
zt/Q9S+dkkDDscqp8o+OgvjAmIeGrIMvIsKB2UDjq43LLUM28zk3fnY0OsoFlUxY
jHCn1JTz4Y1HojgmTbQ2UN2UDZITWTrwJG1m+JhP/Z4YEwT2JQSXQAIQs6zUik5i
QfORKXZ7UyB08FMXQ6yndtyRbbqogjVuZC9ctzm+RzxImE7/vDpkQOne3PPk8oaM
uF13GQBRyRrMj9pIQszHo4JQwkNWWDQoM96wuuVYIlf659G7eZk=
=sBpG
-END PGP SIGNATURE-

[SECURITY] [DLA 3496-1] lemonldap-ng security update

2023-07-14 Thread Guilhem Moulin 
-
Debian LTS Advisory DLA-3496-1debian-...@lists.debian.org
https://www.debian.org/lts/security/   Guilhem Moulin
July 14, 2023 https://wiki.debian.org/LTS
-

Package: lemonldap-ng
Version: 2.0.2+ds-7+deb10u9
CVE ID : CVE-2023-28862

Issues were discovered in Lemonldap::NG, an OpenID-Connect, CAS and SAML
compatible Web-SSO system, which could lead to impersonation of users
with a second factor authentication.

Weak session ID generation in the AuthBasic handler and incorrect
failure handling during a password check allow attackers to bypass 2FA
verification.  Any plugin that tries to deny session creation after the
store step does not deny an AuthBasic session.

Using the AuthBasic handler is now refused for users with a second
factor.  Admins who are *absolutely sure* that such accounts should be
able to use AuthBasic handlers (which are password only) can append `and
not $ENV{AuthBasic}` to the 2FA activation rules.

For Debian 10 buster, these problems have been fixed in version
2.0.2+ds-7+deb10u9.

We recommend that you upgrade your lemonldap-ng packages.

For the detailed security status of lemonldap-ng please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/lemonldap-ng

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS


signature.asc
Description: PGP signature