Debian Security Advisory

DLA-3487-1 fusiondirectory -- LTS security update

Date Reported:
08 Jul 2023
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2022-36179, CVE-2022-36180.
More information:

A potential Cross Site Scripting (XSS) vulnerablity (CVE-2022-36180) and session handling vulnerability (CVE-2022-36179 )have been found in fusiondirectory, a Web Based LDAP Administration Program.

Additionally, fusiondirectory has been updated to address the API change in php-cas due to CVE-2022-39369. see DLA 3485-1Add for details.

Due to this, if CAS authentication is used, fusiondirectory will stop working until those steps are done:

- make sure to install the updated fusiondirectory-schema package for buster.

- update the fusiondirectory core schema in LDAP by running fusiondirectory-insert-schema -m

- switch to using the new php-cas API by running fusiondirectory-setup --set-config-CasLibraryBool=TRUE

- set the CAS ClientServiceName to the base URL of the fusiondirectory installation, for example: fusiondirectory-setup --set-config-CasClientServiceName=""

For Debian 10 buster, these problems have been fixed in version 1.2.3-4+deb10u2.

We recommend that you upgrade your fusiondirectory packages.

For the detailed security status of fusiondirectory please refer to its security tracker page at:

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: