CVE-2021-35472: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in LemonLDAP::NG before version 2.0.12 (CVE-2021-35472). The vulnerability involves session cache corruption that can lead to authorization bypass or spoofing. The issue was disclosed in July 2021 and affects LemonLDAP::NG installations from version 2.0.0 to 2.0.11 (NVD, Debian Security).

The vulnerability allows an attacker to potentially be authenticated alternately as one of two different users by running a loop that makes many authentication attempts. The issue received a CVSS v3.1 Base Score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The vulnerability is classified as CWE-307 (Improper Restriction of Excessive Authentication Attempts) (NVD).

The vulnerability could result in information disclosure, authentication bypass, or allow an attacker to increase their authentication level or impersonate another user. This is particularly critical when LemonLDAP::NG is configured to increase authentication level for users authenticated via a second factor (Debian Security).

The vulnerability has been fixed in LemonLDAP::NG version 2.0.12. For Debian's stable distribution (buster), the fix was released in version 2.0.2+ds-7+deb10u6. Users are recommended to upgrade their LemonLDAP::NG installations to the patched versions (Debian Security).