Unscored CVE-2012-6426 EUVD-2012-6281GHSA-9q8m-r734-6gg5

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass…

Published Jan 1, 2013 · Updated Sep 16, 2024 · Assigned by mitre

Description

LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	lemonldap-ng	1.2.2-3	—
Debian 13	lemonldap-ng	1.2.2-3	—
Debian 12	lemonldap-ng	1.2.2-3	—

References

http://jira.ow2.org/browse/LEMONLDAP-570
[oss-security] 20121219 [CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping mailing-list
[oss-security] 20121220 Re: [CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping mailing-list