CVE catalog

CVE-2020-36658

libapache-session-ldap-perl: CVE-2020-36658

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
0.44% · Oct 25, 2026

In Apache::Session::LDAP before 0.5, validity of the X.509 certificate is not checked by default when connecting to remote LDAP backends, because the default configuration of the Net::LDAPS module for Perl is used. NOTE: this can, for example, be fixed in conjunction with the CVE-2020-16093 fix.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibapache-session-ldap-perlsid0.5-1fixed
Debianlibapache-session-ldap-perlforky0.5-1fixed
Debianlibapache-session-ldap-perltrixie0.5-1fixed
Debianlibapache-session-ldap-perlbookworm0.5-1fixed
Ubuntulibapache-session-ldap-perlpro0.4-1vulnerable
Ubuntulibapache-session-ldap-perlpro0.4-1ubuntu0.18.04.1~esm1fixed
Ubuntulibapache-session-ldap-perl20.040.4-1vulnerable
Ubuntulibapache-session-ldap-perl20.040.4-1+deb10u1build0.20.04.1fixed
Ubuntulibapache-session-ldap-perlpro0.4-1vulnerable
Ubuntulibapache-session-ldap-perlpro0.4-1ubuntu0.18.04.1~esm1fixed
Ubuntulibapache-session-ldap-perl20.040.4-1vulnerable
Ubuntulibapache-session-ldap-perl20.040.4-1+deb10u1build0.20.04.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibapache-session-ldap-perlsourcesid0.5-1not yet assignedNot reportedNot reported
Debianlibapache-session-ldap-perlsourceforky0.5-1not yet assignedNot reportedNot reported
Debianlibapache-session-ldap-perlsourcetrixie0.5-1not yet assignedNot reportedNot reported
Debianlibapache-session-ldap-perlsourcebookworm0.5-1not yet assignedNot reportedNot reported
Ubuntulibapache-session-ldap-perldebpro0.4-1ubuntu0.18.04.1~esm1Not reportedUSN-6596-1Not reported
Ubuntulibapache-session-ldap-perldeb20.040.4-1+deb10u1build0.20.04.1Not reportedUSN-6596-1Not reported
Ubuntulibapache-session-ldap-perldebpro0.4-1ubuntu0.18.04.1~esm1Not reportedUBUNTU-CVE-2020-36658Not reported
Ubuntulibapache-session-ldap-perldeb20.040.4-1+deb10u1build0.20.04.1Not reportedUBUNTU-CVE-2020-36658Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache-session-ldap-perl]Fixed
    Details (2)

    • 0.5-1 · all · bookworm

      Fixed · Fixed: 0.5-1

      dsa · libapache-session-ldap-perl · debian · bookworm; dsa · libapache-session-ldap-perl · debian · 12

    • 0.5-1 · all · bookworm

      Fixed · Fixed: 0.5-1

      dsa · libapache-session-ldap-perl · debian · bookworm; dsa · libapache-session-ldap-perl · debian · 12

[Debian 13 (Trixie)]

  • [libapache-session-ldap-perl]Fixed
    Details (2)

    • 0.5-1 · all · trixie

      Fixed · Fixed: 0.5-1

      dsa · libapache-session-ldap-perl · debian · 13

    • 0.5-1 · all · trixie

      Fixed · Fixed: 0.5-1

      dsa · libapache-session-ldap-perl · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]