[GHSA-q34c-v76q-8jx6] LedgerSMB does not set the 'Secure' attribute on the...

[tjuyuxinzhang]

Updates

• Affected products
• References
• Source code location
• Summary

Comments
This update corrects and improves the advisory based on the official LedgerSMB security advisory for CVE-2021-3882.

The affected version range has been corrected to 1.8.0 through 1.8.21 (inclusive), with version 1.8.22 as the first fixed release, as explicitly stated in the upstream advisory:
https://ledgersmb.org/cve-2021-3882-sensitive-non-secure-cookie

The same source also confirms that only the 1.8.x release line is affected, and that versions 1.7.x and 1.9.x are not impacted:
"Users of LedgerSMB 1.7 or 1.9 are unaffected by this vulnerability."

Additionally, the vulnerability description has been refined to align with the upstream explanation that the issue is caused by the absence of the 'Secure' attribute on session cookies when LedgerSMB is deployed behind a reverse proxy, enabling session hijacking via HTTP downgrade under specific conditions.

The attack scenario and impact have been updated based on the official advisory, which clearly states that:

• exploitation requires HTTP access, network interception capability, and user interaction
• session cookies are encrypted but still usable for authentication if captured

These changes ensure the advisory is fully consistent with authoritative vendor documentation and accurately reflects the affected versions, root cause, and real-world exploitability.