lemonldap-ng (2.0.9+ds-1) unstable; urgency=medium

  CVE-2020-24660
  lemonldap-ng community fixed a vulnerability in Nginx default
  configuration files (CVE-2020-24660).
  Debian package does not install any default site, but documentation
  provided bad examples in Nginx configuration before this version. If you
  use lemonldap-ng handler with Nginx, you should verify your configuration
  files.
  Upstream community recommends to fix X_ORIGINAL_URI variable:

    location = /lmAuth {
      fastcgi_param X_ORIGINAL_URI  $request_uri;
      # or uwsgi_param X_ORIGINAL_URI $original_uri;
      ...
    }
    location = /protected-area {
      set $original_uri $uri$is_args$args;
      ...
    }

  The updated example file is installed in documentation:
  /usr/share/doc/lemonldap-ng-handler/examples/test-nginx.conf

  CVE-2020-16093
  LDAP server certificates were previously not verified by default when
  using secure transports (LDAPS or TLS). Starting from this release,
  certificate validation is now enabled by default, including on existing
  installations.
  If you have configured your CA certificates incorrectly, LemonLDAP::NG
  will now start complaining about invalid certificates. You may temporarily
  disable it again with the following command:

    /usr/share/lemonldap-ng/bin/lemonldap-ng-cli set ldapVerify none

  If you use LDAP as a session backend, you are strongly encouraged to also
  upgrade corresponding Apache::Session module (Apache::Session::LDAP 0.5 or
  libapache-session-browseable-perl 1.3.8). After this upgrade, if you want
  to temporarily disable certificate validation, you can add the following
  parameter to the list of Apache::Session module options:

   - key:   ldapVerify
   - value: none

 -- Xavier Guimard <yadd@debian.org>  Mon, 07 Sep 2020 09:35:09 +0200
