A potential Cross Site Scripting (XSS) vulnerablity ([CVE-2022-36180](https://security-tracker.debian.org/tracker/CVE-2022-36180)) and
session handling vulnerability ([CVE-2022-36179](https://security-tracker.debian.org/tracker/CVE-2022-36179) )have been found in
fusiondirectory, a Web Based LDAP Administration Program.

Additionally, fusiondirectory has been updated to address the API change
in php-cas due to [CVE-2022-39369](https://security-tracker.debian.org/tracker/CVE-2022-39369). see DLA 3485-1Add for details.

Due to this, if CAS authentication is used, fusiondirectory
will stop working until those steps are done:

– make sure to install the updated fusiondirectory-schema package for
buster.

– update the fusiondirectory core schema in LDAP by running
fusiondirectory-insert-schema -m

– switch to using the new php-cas API by running
fusiondirectory-setup –set-config-CasLibraryBool=TRUE

– set the CAS ClientServiceName to the base URL of the fusiondirectory
installation, for example:
fusiondirectory-setup –set-config-CasClientServiceName=”https://fusiondirectory.example.org/”

For Debian 10 buster, these problems have been fixed in version
1.2.3-4+deb10u2.

We recommend that you upgrade your fusiondirectory packages.

For the detailed security status of fusiondirectory please refer to
its security tracker page at:

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: Read More