Summary
[2.4.10-1]
Rebase to 2.4.10 version improves state cookies piling up problem
Resolves: RHEL-32450 Race condition in mod_auth_openidc filecache
Resolves: RHEL-25422 mod_auth_openidc: DoS when using
OIDCSessionType client-cookie and manipulating cookies
(CVE-2024-24814)
Fixed packages 1
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 9 | mod_auth_openidc | 0:2.4.10-1.el9 |
Vulnerabilities 1
-
High 7.5
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks co…