Approved changes feed: RSS · Atom
cpe:2.3:a:netflix:lemur:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Netflix (f1ee56ff-77ab-5372-890c-4c8d187c3b7c) |
|---|---|
| Product | Lemur (8df732ea-7bf6-5eab-a2ea-148daad5df48) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/netflix/lemur |
purl2cpe | 2026-06-01 10:14:04.669413 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-44305 |
vulnerable | 2026-06-08 08:05:10.569010 |
Lemur: LDAP TLS certificate verification globally disabled enables credential interception
MEDIUM (6.8)
Lemur manages TLS certificate creation. Prior to 1.9.0, when LDAP TLS is enabled (LDAP_USE_TLS = True), Lemur's LDAP authentication module unconditionally disables TLS certificate verification at the global ldap module level. This allows a man-in-the-middle attacker positioned between Lemur and the LDAP server to intercept all authentication credentials. This vulnerability is fixed in 1.9.0.
Published: 2026-05-12T21:28:06.362Z
Updated: 2026-05-13T14:26:51.752Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-44304 |
vulnerable | 2026-06-08 08:05:10.568754 |
Lemur: LDAP Filter Injection enables post-authentication privilege escalation
HIGH (8.1)
Lemur manages TLS certificate creation. Prior to 1.9.0, Lemur's LDAP authentication module (lemur/auth/ldap.py) constructs LDAP search filters using unsanitized user input via Python string interpolation. An authenticated LDAP user can inject LDAP filter metacharacters through the username field to manipulate group membership queries and escalate their privileges to administrator. This vulnerability is fixed in 1.9.0.
Published: 2026-05-12T21:27:28.118Z
Updated: 2026-05-14T12:33:51.765Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-30797 |
vulnerable | 2026-06-08 06:04:41.169053 |
Insecure Random Generation in Netflix Lemur
HIGH (7.5)
Netflix Lemur before version 1.3.2 used insufficiently random values when generating default credentials. The insufficiently random values may allow an attacker to guess the credentials and gain access to resources managed by Lemur.
Published: 2023-04-19T19:10:12.523Z
Updated: 2026-07-15T01:24:50.449Z Reference links |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.