CVE-2024-52948

unknown

Published — · Modified —

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

—

Description

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2024-52948 NameCVE-2024-52948 DescriptionCSRF on 2FA registration SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) ReferencesDLA-4602-1 Vulnerable and fixed packages The table below lists information on source packages. Source PackageReleaseVersionStatus lemonldap-ng…

CVE-2024-52948

Name	CVE-2024-52948
Description	CSRF on 2FA registration
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-4602-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
lemonldap-ng (PTS)	bullseye	2.0.11+ds-4+deb11u5	vulnerable
	bullseye (security)	2.0.11+ds-4+deb11u8	fixed
	bookworm	2.16.1+ds-deb12u8	fixed
	bookworm (security)	2.16.1+ds-deb12u6	fixed
	trixie	2.21.2+ds-1+deb13u2	fixed
	forky, sid	2.22.3+ds-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
lemonldap-ng	source	bullseye	2.0.11+ds-4+deb11u8	DLA-4602-1
lemonldap-ng	source	bookworm	2.16.1+ds-deb12u5
lemonldap-ng	source	(unstable)	2.20.2+ds-1

Notes

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3258
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/0e69ee17ee7e78569a6f7a3c859105e958d374d4
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/d65bd9cb8e9a620f71214d87e937747d7b415999
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/9923ed4479b3c71549f9a9660f77dc03331eac30
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/dfe9ddc40de982a33fbff42a143ccd1b786de775
Backports for 2.20 (in v2.20.2): https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/merge_requests/638
Backports for 2.16 (in v2.16.4): https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/merge_requests/644

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/3258https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/0e69ee17ee7e78569a6f7a3c859105e958d374d4https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/d65bd9cb8e9a620f71214d87e937747d7b415999https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/9923ed4479b3c71549f9a9660f77dc03331eac30https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/dfe9ddc40de982a33fbff42a143ccd1b786de775Backports for 2.20 (in v2.20.2): https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/merge_requests/638Backports for 2.16 (in v2.16.4): https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/merge_requests/644

OS impact

Debian Fixed 5 releases

Version	Status	Fixed in
trixie	Fixed	`2.20.2+ds-1`
sid	Fixed	`2.20.2+ds-1`
forky	Fixed	`2.20.2+ds-1`
bullseye	Fixed	`2.0.11+ds-4+deb11u8`
bookworm	Fixed	`2.16.1+ds-deb12u5`

References

https://security-tracker.debian.org/tracker/CVE-2024-52948

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.