PT-2022-8581 · Unknown · Lemonldap::Ng+1

Maxime Besson · Published 2022-07-17 · Updated 2025-04-03 · CVE-2020-16093

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions LemonLDAP::NG versions prior to 2.0.9

Description The issue concerns the validity of X.509 certificates not being checked by default when connecting to remote LDAP backends. This is due to the default configuration of the Net::LDAPS module for Perl being used.

Recommendations For versions prior to 2.0.9, update to version 2.0.9 or later to ensure the validity of X.509 certificates is properly checked when connecting to remote LDAP backends.

Exploit

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

CVE-2020-16093

DLA-3284-1

DLA-3285-1

DLA-3287-1

Affected Products

Lemonldap::Ng

Net::Ldaps

References · 23

• 🔥 https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2250 · Exploit
• https://osv.dev/vulnerability/DLA-3284-1 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-16093 · Vendor Advisory
• https://lemonldap-ng.org/download · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16093 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-16093 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-16093 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16093 · Security Note
• https://osv.dev/vulnerability/DLA-3287-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-16093 · Security Note
• https://ubuntu.com/security/CVE-2020-16093 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3285-1 · Vendor Advisory
• https://t.me/cvenotify/45188 · Telegram Post
• https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html · Note
• https://t.me/cibsecurity/57022 · Telegram Post