CVE-2022-37186: Medium severity lemonldap-ng Lemonldap\ vulnerability
In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/lemonldap-ngto a version that resolves this vulnerability.Fixed in 2.16.1+ds-deb12u8Fixed in 2.16.1+ds-deb12u10Fixed in 2.21.2+ds-1+deb13u3Fixed in 2.21.2+ds-1+deb13u4Fixed in 2.23.4+ds+~0.5.5-1 - Upgrade
Upgrade
debian/lemonldap-ngto a version that resolves this vulnerability.Fixed in 2.0.15+ds-1
Event History
Frequently Asked Questions
What is the severity of CVE-2022-37186?
The severity of CVE-2022-37186 is rated as medium with a CVSS score of 5.9.
How can I mitigate CVE-2022-37186?
To mitigate CVE-2022-37186, users are recommended to update LemonLDAP::NG to version 2.0.15 or later.
What can happen if LemonLDAP::NG sessions are not deleted according to the timeoutActivity setting?
If sessions are not deleted as intended, it can result in sessions not being cleared automatically leading to potential security risks and data exposure.
Is CVE-2022-37186 related to manual session removal in LemonLDAP::NG?
CVE-2022-37186 in LemonLDAP::NG is related to situations where manual removal of a session before it should be automatically deleted can cause sessions to not be cleared as expected.