Summary
cjose
mod_auth_openidc
[2.4.9.4-8]
- Resolves: RHEL-87759 - Empty POST causes crash with OIDCPreservePost
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | cjose | 0:0.6.1-4.module+el8.10.0+90549+7b4eddfc |
| Oracle Linux · 8 | cjose-devel | 0:0.6.1-4.module+el8.10.0+90549+7b4eddfc |
| Oracle Linux · 8 | mod_auth_openidc | 0:2.4.9.4-8.module+el8.10.0+90568+7a187228 |
Vulnerabilities 1
-
High 7.5
Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistent…