Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1261099 > unrolled thread

Bug#1114979: trixie-pu: package lemonldap-ng/2.21.2+ds-1+deb13u

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#1114979: trixie-pu: package lemonldap-ng/2.21.2+ds-1+deb13u Yadd <yadd@debian.org> - 2025-09-12 13:20 +0200
    Bug#1114979: Update Jonathan Wiltshire <jmw@debian.org> - 2025-10-19 17:50 +0200
      Bug#1114979: Update Salvatore Bonaccorso <carnil@debian.org> - 2025-11-02 14:30 +0100
    Bug#1114979: lemonldap-ng 2.21.2+ds-1+deb13u1 flagged for acceptance Adam D Barratt <adam@adam-barratt.org.uk> - 2025-11-02 20:20 +0100

#1261099 — Bug#1114979: trixie-pu: package lemonldap-ng/2.21.2+ds-1+deb13u

[Multipart message — attachments visible in raw view] — view raw

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: lemonldap-ng@packages.debian.org, yadd@debian.org
Control: affects -1 + src:lemonldap-ng
User: release.debian.org@packages.debian.org
Usertags: pu

[ Reason ]
Lemonldap-ng is vulnerable to 2 little security issues and one bug that
may block some users:
 * #3445: Google OIDC authentication module fails with "No response type provided"
 * #3446: [security:low] session id exposed in portal AJAX responses
 * #3462: [security:low] Shell injection in Safe Jail

[ Impact ]
 * Bug for people who want to use "authentify with Google"
 * Low security issue when notification is used, admin can write files
   with the www-data rights
 * Low security issue, Ajax response contain a value (which exist in
   cookie anyway)

[ Tests ]
Patches contain additional tests for this issue

[ Risks ]
Low risk: patches are trivial and lemonldap-ng has no reverse
dependencies and test coverage is good

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

Important: there are 2 options (exactly the same code):
- add 3 patches
- import 2.21.3

I joined the 2 debdiff to let you choose

Cheers,
Xavier

[toc] | [next] | [standalone]

#1266693 — Bug#1114979: Update

Control: tag -1 confirmed

Hi,

Please go ahead. (2.21.4~deb13u1 would be incorrect; 2.21.2+ds-1+deb13u1 is
fine.)

Thanks,

-- 
Jonathan Wiltshire                                      jmw@debian.org
Debian Developer                         http://people.debian.org/~jmw

4096R: 0xD3524C51 / 0A55 B7C5 1223 3942 86EC  74C3 5394 479D D352 4C51
ed25519/0x196418AAEB74C8A1: CA619D65A72A7BADFC96D280196418AAEB74C8A1

[toc] | [prev] | [next] | [standalone]

#1268777 — Bug#1114979: Update

Hi Yadd,

On Sun, Oct 19, 2025 at 04:44:32PM +0100, Jonathan Wiltshire wrote:
> Control: tag -1 confirmed
> 
> Hi,
> 
> Please go ahead. (2.21.4~deb13u1 would be incorrect; 2.21.2+ds-1+deb13u1 is
> fine.)

have you noticed the ack from Jonathan? Can you please upload so we
can make it in time for the next trixie point release please?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#1268825 — Bug#1114979: lemonldap-ng 2.21.2+ds-1+deb13u1 flagged for acceptance

package release.debian.org
tags 1114979 = trixie pending
thanks

Hi,

The upload referenced by this bug report has been flagged for acceptance into the proposed-updates queue for Debian trixie.

Thanks for your contribution!

Upload details
==============

Package: lemonldap-ng
Version: 2.21.2+ds-1+deb13u1

Explanation: fix command injection issue [CVE-2025-59518]; don't expose session-id into Ajax responses; fix Google authentication

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web