CVE-2012-6426
Published on: 01/01/2013 12:00:00 AM UTC
Last Modified on: 03/23/2021 11:28:22 PM UTC
Certain versions of Lemonldap from Lemonldap-ng contain the following vulnerability:
LemonLDAP::NG before 1.2.3 does not use the signature-verification capability of the Lasso library, which allows remote attackers to bypass intended access-control restrictions via crafted SAML data.
- CVE-2012-6426 has been assigned by
[email protected] to track the vulnerability
CVSS2 Score: 7.5 - HIGH
| Access Vector ⓘ |
Access Complexity |
Authentication |
|---|---|---|
| NETWORK | LOW | NONE |
| Confidentiality Impact |
Integrity Impact |
Availability Impact |
| PARTIAL | PARTIAL | PARTIAL |
CVE References
| Description | Tags ⓘ | Link |
|---|---|---|
| oss-security - [CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping | openwall.com text/html |
MLIST [oss-security] 20121219 [CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping |
| [#LEMONLDAP-570] SAML messages signatures are not verified - SECURITY ISSUE - OW2 Consortium Jira | Patch web.archive.org text/html Inactive LinkNot Archived |
CONFIRM jira.ow2.org/browse/LEMONLDAP-570 |
| oss-security - Re: [CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping | openwall.com text/html |
MLIST [oss-security] 20121220 Re: [CVE-2012-6426] LemonLDAP-NG SAML XML Signature Wrapping |
There are currently no QIDs associated with this CVE
Known Affected Configurations (CPE V2.3)
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.6:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.7:beta:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.8:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.8.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.8.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.8.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.9:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.9.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.9.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.9.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::0.9.4:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0:rc1:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0:rc2:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0.4:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0.5:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.0.6:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.1.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.1.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.1.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.2.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::1.2.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap:::*:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.6:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.7:beta:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.4:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0:rc1:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0:rc2:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.4:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.5:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.6:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.1.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.1.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.1.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.2.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.2.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.6:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.7:beta:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.8.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::0.9.4:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0:rc1:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0:rc2:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.3:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.4:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.5:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.0.6:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.1.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.1.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.1.2:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.2.0:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::1.2.1:*:*:*:*:*:
- cpe:2.3:a:lemonldap-ng:lemonldap\:\::*:*:*:*:*:*:
No vendor comments have been submitted for this CVE