In LemonLDAP::NG before 2.0.15. some sessions are not deleted when they are supposed to be deleted according to the timeoutActivity setting. This can occur when there are at least two servers, and a session is manually removed before the time at which it would have been removed automatically.
Weakness
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Lemonldap::ng | Lemonldap-ng | * | 2.0.15 (excluding) |
| Lemonldap-ng | Ubuntu | bionic | * |
| Lemonldap-ng | Ubuntu | focal | * |
| Lemonldap-ng | Ubuntu | kinetic | * |
| Lemonldap-ng | Ubuntu | lunar | * |
| Lemonldap-ng | Ubuntu | trusty | * |
| Lemonldap-ng | Ubuntu | upstream | * |
| Lemonldap-ng | Ubuntu | xenial | * |
Potential Mitigations
References
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15
- https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/commit/59c781b393947663ad3bf26bad0581413dd6fae4
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2758
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/releases/v2.0.15
- https://lists.debian.org/debian-lts-announce/2023/01/msg00027.html