GHSA-x44x-r84w-8v67
Lack of URL normalization may lead to authorization bypass when URL access rules are used
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | lemonldap-ng-handler | < 0.5.2 | 0.5.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
### Impact
When access rules are used inside a protected host, some URL encodings may bypass filtering system.
### Patches
Version 0.5.2 includes a patch that fixes the vulnerability
### Workarounds
No way for users to fix or remediate the vulnerability without upgrading
### References
https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290
### For more information
If you have any questions or comments about this advisory:
* Open an issue in [this repository](https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/issues) or [LemonLDAP::NG GitLab](https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues)
* Email us at [[email protected]](mailto:[email protected])
References
External links from the advisory. They lead to third-party sites.
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/security/advisories/GHSA-x44x-r84w-8v67
- https://nvd.nist.gov/vuln/detail/CVE-2020-24660
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/commit/136aa83ed431462fa42ce17b7f9b24e056de06be
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler
- https://github.com/LemonLDAPNG/node-lemonldap-ng-handler/releases/tag/0.5.2
- https://gitlab.ow2.org/lemonldap-ng/lemonldap-ng/-/issues/2290
- https://snyk.io/vuln/SNYK-JS-NODELEMONLDAPNGHANDLER-655999
- https://www.debian.org/security/2020/dsa-4762
- https://www.npmjs.com/package/lemonldap-ng-handler