Summary
cjose
mod_auth_openidc
[2.4.9.4-6]
- Resolves: RHEL-36492 Race condition in mod_auth_openidc filecache
- Resolves: RHEL-25421 mod_auth_openidc: DoS when using
OIDCSessionType client-cookie and manipulating cookies
(CVE-2024-24814)
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | cjose | 0:0.6.1-4.module+el8.10.0+90385+c8f58f84 |
| Oracle Linux · 8 | cjose-devel | 0:0.6.1-4.module+el8.10.0+90385+c8f58f84 |
| Oracle Linux · 8 | mod_auth_openidc | 0:2.4.9.4-6.module+el8.10.0+90385+c8f58f84 |
Vulnerabilities 1
-
High 7.5
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks co…