CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
73.6%
Package : fusiondirectory
Version : 1.2.3-4+deb10u2
CVE ID : CVE-2022-36179 CVE-2022-36180
Debian Bug :
A potential Cross Site Scripting (XSS) vulnerablity (CVE-2022-36180) and
session handling vulnerability (CVE-2022-36179 )have been found in
fusiondirectory, a Web Based LDAP Administration Program.
Additionally, fusiondirectory has been updated to address the API change
in php-cas due to CVE-2022-39369, see DLA 3485-1 for details.
Due to this, if CAS authentication is used, fusiondirectory
will stop working until those steps are done:
make sure to install the updated fusiondirectory-schema package for
buster.
update the fusiondirectory core schema in LDAP by running
fusiondirectory-insert-schema -m
switch to using the new php-cas API by running
fusiondirectory-setup --set-config-CasLibraryBool=TRUE
set the CAS ClientServiceName to the base URL of the fusiondirectory
installation, for example:
fusiondirectory-setup --set-config-CasClientServiceName="https://fusiondirectory.example.org/"
For Debian 10 buster, these problems have been fixed in version
1.2.3-4+deb10u2.
We recommend that you upgrade your fusiondirectory packages.
For the detailed security status of fusiondirectory please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/fusiondirectory
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: PGP signature
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
AI Score
Confidence
High
EPSS
Percentile
73.6%