CVE-2020-16093
published 2022-07-18CVE-2020-16093: In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because…
PriorityP337high7.5CVSS 3.1
AVNACLPRNUINSUCNIHAN
EPSS
0.67%
48.0th percentile
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | lemonldap-ng | < lemonldap-ng 2.0.9+ds-1 (bookworm) | lemonldap-ng 2.0.9+ds-1 (bookworm) |
| debian | libapache-session-browseable-perl | < libapache-session-browseable-perl 1.3.7-1 (bookworm) | libapache-session-browseable-perl 1.3.7-1 (bookworm) |
| debian | libapache-session-ldap-perl | < libapache-session-ldap-perl 0.5-1 (bookworm) | libapache-session-ldap-perl 0.5-1 (bookworm) |
| lemonldap-ng | apache | < 0.5 | 0.5 |
| lemonldap-ng | apache | < 1.3.6 | 1.3.6 |
| lemonldap-ng | lemonldap | <= 2.0.8 | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
osv7.5HIGH
vendor_debian7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Debian
CVE-2020-16093: lemonldap-ng - In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certifi...
vendor_debian·2020·CVSS 7.5
CVE-2020-16093 [HIGH] CVE-2020-16093: lemonldap-ng - In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certifi...
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.
Scope: local
bookworm: resolved (fixed in 2.0.9+ds-1)
bullseye: resolved (fixed in 2.0.9+ds-1)
forky: resolved (fixed in 2.0.9+ds-1)
sid: resolved (fixed in 2.0.9+ds-1)
trixie: resolved (fixed in 2.0.9+ds-1)
Debian
CVE-2020-36659: libapache-session-browseable-perl - In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate i...
vendor_debian·2020·CVSS 7.5
CVE-2020-36659 [HIGH] CVE-2020-36659: libapache-session-browseable-perl - In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate i...
In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
Scope: local
bookworm: resolved (fixed in 1.3.7-1)
bullseye: resolved (fixed in 1.3.7-1)
forky: resolved (fixed in 1.3.7-1)
sid: resolved (fixed in 1.3.7-1)
trixie: resolved (fixed in 1.3.7-1)
Debian
CVE-2020-36658: libapache-session-ldap-perl - In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not ch...
vendor_debian·2020·CVSS 7.5
CVE-2020-36658 [HIGH] CVE-2020-36658: libapache-session-ldap-perl - In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not ch...
In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
Scope: local
bookworm: resolved (fixed in 0.5-1)
bullseye: resolved (fixed in 0.5-1)
forky: resolved (fixed in 0.5-1)
sid: resolved (fixed in 0.5-1)
trixie: resolved (fixed in 0.5-1)
GHSA
GHSA-qf7m-fmfh-9c8v: In Apache::Session::LDAP before 0
ghsa_unreviewed·2023-01-27·CVSS 7.5
CVE-2020-36658 [HIGH] CWE-295 GHSA-qf7m-fmfh-9c8v: In Apache::Session::LDAP before 0
In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
GHSA
GHSA-crqh-wr78-6jgr: In Apache::Session::Browseable before 1
ghsa_unreviewed·2023-01-27·CVSS 7.5
CVE-2020-36659 [HIGH] CWE-295 GHSA-crqh-wr78-6jgr: In Apache::Session::Browseable before 1
In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
OSV
CVE-2020-36658: In Apache::Session::LDAP before 0
osv·2023-01-27·CVSS 7.5
CVE-2020-36658 [HIGH] CVE-2020-36658: In Apache::Session::LDAP before 0
In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
OSV
CVE-2020-36659: In Apache::Session::Browseable before 1
osv·2023-01-27·CVSS 7.5
CVE-2020-36659 [HIGH] CVE-2020-36659: In Apache::Session::Browseable before 1
In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
GHSA
GHSA-9c48-27fx-7952: In LemonLDAP::NG (aka lemonldap-ng) through 2
ghsa_unreviewed·2022-07-19
CVE-2020-16093 [HIGH] CWE-295 GHSA-9c48-27fx-7952: In LemonLDAP::NG (aka lemonldap-ng) through 2
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.
OSV
CVE-2020-16093: In LemonLDAP::NG (aka lemonldap-ng) through 2
osv·2022-07-18·CVSS 7.5
CVE-2020-16093 [HIGH] CVE-2020-16093: In LemonLDAP::NG (aka lemonldap-ng) through 2
In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2250https://lemonldap-ng.org/downloadhttps://lists.debian.org/debian-lts-announce/2023/01/msg00027.htmlhttps://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2250https://lemonldap-ng.org/downloadhttps://lists.debian.org/debian-lts-announce/2023/01/msg00027.html
2022-07-18
Published