In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3285 advisory.

  - In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by     default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS     module for Perl is used. (CVE-2020-16093)

  - In Apache::Session::Browseable before 1.3.6, validity of the X.509 certificate is not checked by default     when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for     Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.
    (CVE-2020-36659)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3284 advisory.

  - In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by     default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS     module for Perl is used. (CVE-2020-16093)

  - In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when     connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is     used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix. (CVE-2020-36658)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3287 advisory.

  - In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by     default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS     module for Perl is used. (CVE-2020-16093)

  - In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted     according to the timeoutActivity setting. This can occur when there are at least two servers, and a     session is manually removed before the time at which it would have been removed automatically.
    (CVE-2022-37186)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
170889	Debian DLA-3285-1 : libapache-session-browseable-perl - LTS security update	Nessus	Debian Local Security Checks	high
170887	Debian DLA-3284-1 : libapache-session-ldap-perl - LTS security update	Nessus	Debian Local Security Checks	high
170758	Debian DLA-3287-1 : lemonldap-ng - LTS security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2020-16093

high

Tenable Plugins

high

high

high