Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #1261099

Bug#1114979: trixie-pu: package lemonldap-ng/2.21.2+ds-1+deb13u

Cross-posted to 2 groups.

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

Package: release.debian.org
Severity: normal
Tags: trixie
X-Debbugs-Cc: lemonldap-ng@packages.debian.org, yadd@debian.org
Control: affects -1 + src:lemonldap-ng
User: release.debian.org@packages.debian.org
Usertags: pu

[ Reason ]
Lemonldap-ng is vulnerable to 2 little security issues and one bug that
may block some users:
 * #3445: Google OIDC authentication module fails with "No response type provided"
 * #3446: [security:low] session id exposed in portal AJAX responses
 * #3462: [security:low] Shell injection in Safe Jail

[ Impact ]
 * Bug for people who want to use "authentify with Google"
 * Low security issue when notification is used, admin can write files
   with the www-data rights
 * Low security issue, Ajax response contain a value (which exist in
   cookie anyway)

[ Tests ]
Patches contain additional tests for this issue

[ Risks ]
Low risk: patches are trivial and lemonldap-ng has no reverse
dependencies and test coverage is good

[ Checklist ]
  [X] *all* changes are documented in the d/changelog
  [X] I reviewed all changes and I approve them
  [X] attach debdiff against the package in (old)stable
  [X] the issue is verified as fixed in unstable

Important: there are 2 options (exactly the same code):
- add 3 patches
- import 2.21.3

I joined the 2 debdiff to let you choose

Cheers,
Xavier

Back to linux.debian.bugs.dist | Previous | Next — Next in thread | Find similar | Unroll thread

Thread

Bug#1114979: trixie-pu: package lemonldap-ng/2.21.2+ds-1+deb13u Yadd <yadd@debian.org> - 2025-09-12 13:20 +0200
  Bug#1114979: Update Jonathan Wiltshire <jmw@debian.org> - 2025-10-19 17:50 +0200
    Bug#1114979: Update Salvatore Bonaccorso <carnil@debian.org> - 2025-11-02 14:30 +0100
  Bug#1114979: lemonldap-ng 2.21.2+ds-1+deb13u1 flagged for acceptance Adam D Barratt <adam@adam-barratt.org.uk> - 2025-11-02 20:20 +0100

csiph-web