CVE-2024-45160

unknown

Published — · Modified —

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret).

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2024-45160 NameCVE-2024-45160 DescriptionIncorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret). SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)…

CVE-2024-45160

Name	CVE-2024-45160
Description	Incorrect credential validation in LemonLDAP::NG 2.18.x and 2.19.x before 2.19.2 allows attackers to bypass OAuth2 client authentication via an empty client_password parameter (client secret).
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lemonldap-ng (PTS)	bullseye	2.0.11+ds-4+deb11u5	fixed
	bullseye (security)	2.0.11+ds-4+deb11u8	fixed
	bookworm	2.16.1+ds-deb12u8	fixed
	bookworm (security)	2.16.1+ds-deb12u6	fixed
	trixie	2.21.2+ds-1+deb13u2	fixed
	forky	2.22.3+ds-1	fixed
	sid	2.23.0+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
lemonldap-ng	source	bullseye	(not affected)
lemonldap-ng	source	bookworm	(not affected)
lemonldap-ng	source	(unstable)	2.19.2+ds-1

Notes

[bookworm] - lemonldap-ng <not-affected> (Vulnerable code not present)
[bullseye] - lemonldap-ng <not-affected> (Vulnerable code not present)
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3223
Introduced by: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/06d771cbc2d5c752354c50f83e4912e5879f9aa2 (v2.18.0)
Unit test: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/236cdfe42c1dc04a15a4a40c5e6a8c2e858d71d7 (v2.19.2)
Fixed by: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/696f49a0855faeb271096dccb8381e2129687c3d (v2.19.2)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

[bookworm] - lemonldap-ng <not-affected> (Vulnerable code not present)[bullseye] - lemonldap-ng <not-affected> (Vulnerable code not present)https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3223Introduced by: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/06d771cbc2d5c752354c50f83e4912e5879f9aa2 (v2.18.0)Unit test: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/236cdfe42c1dc04a15a4a40c5e6a8c2e858d71d7 (v2.19.2)Fixed by: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/696f49a0855faeb271096dccb8381e2129687c3d (v2.19.2)

OS impact

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`2.19.2+ds-1`
sid	Fixed	`2.19.2+ds-1`
forky	Fixed	`2.19.2+ds-1`
bullseye	Fixed	`0`
bookworm	Fixed	`0`

References

https://security-tracker.debian.org/tracker/CVE-2024-45160

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.