/ 
Lemonldap-NG-Common-2.0.3
/ Lemonldap::NG::Common::Apache::Session::REST
Security Advisories (2)
CVE-2020-16093 (2022-07-18)

In LemonLDAP::NG (aka lemonldap-ng) through 2.0.8, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used.

CVE-2020-24660 (2020-09-14)

An issue was discovered in LemonLDAP::NG through 2.0.8, when NGINX is used. An attacker may bypass URL-based access control to protected Virtual Hosts by submitting a non-normalized URI. This also affects versions before 0.5.2 of the "Lemonldap::NG handler for Node.js" package.

NAME

Lemonldap::NG::Common::Apache::Session::REST - Perl extension written to access to Lemonldap::NG Web-SSO sessions via REST.

DESCRIPTION

Lemonldap::NG::Common::Conf provides a simple interface to access to Lemonldap::NG Web-SSO configuration. It is used by Lemonldap::NG::Handler, Lemonldap::NG::Portal and Lemonldap::NG::Manager.

Lemonldap::NG::Common::Apache::Session::REST used with Lemonldap::NG::Portal provides the ability to access to Lemonldap::NG sessions via REST: the portal act as a proxy to access to the real Apache::Session module (see HTML documentation for more)

PARAMETERS

baseUrl (required): remote LLNG portal
realm, user and password (optional): AuthBasic parameters if needed
lwpOpts: LWP::UserAgent options (hash ref)
lwpSlsOpts: LWP::UserAgent SSL options (will be given to LWP::UserAgent constructor in parameter ssl_opts

SEE ALSO

http://lemonldap-ng.org/, Lemonldap::NG::Portal, Apache::Session, LWP::UserAgent

AUTHORS

LemonLDAP::NG team http://lemonldap-ng.org/team

BUG REPORT

Use OW2 system to report bug or ask for features: https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/issues

DOWNLOAD

Lemonldap::NG is available at http://forge.objectweb.org/project/showfiles.php?group_id=274

COPYRIGHT AND LICENSE

See COPYING file for details.

This library is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2, or (at your option) any later version.

This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.

You should have received a copy of the GNU General Public License along with this program. If not, see http://www.gnu.org/licenses/.