Описание
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of mod_auth_openidc. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed Cookie headers (tokens lacking =) can reduce exposure, but upgrading is the recommended remediation.
A flaw was found in mod_auth_openidc, an OpenID Connect Relying Party module for Apache HTTP servers. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed state cookie. This can lead to an out-of-bounds read and a one-byte out-of-bounds write during state cookie parsing, primarily resulting in a Denial of Service (DoS) for the affected server.
Отчет
This is an Important denial of service flaw in mod_auth_openidc. The vulnerability arises from an out-of-bounds read and write in the state-cookie parser when processing specially crafted Cookie headers. Exploitation could lead to service unavailability for systems configured with mod_auth_openidc for OpenID Connect Relying Party functionality.
Меры по смягчению последствий
Inspect incoming HTTP requests using a Web Application Firewall (WAF), reverse proxy, or Apache’s mod_rewrite module prior to evaluation by mod_auth_openidc. Configure security rules to reject or drop any requests containing malformed Cookie headers—specifically OpenID Connect state cookie tokens that lack an equals sign (=).
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | mod_auth_openidc | Affected | ||
| Red Hat Enterprise Linux 7 | mod_auth_openidc | Affected | ||
| Red Hat Enterprise Linux 8 | mod_auth_openidc:2.3/mod_auth_openidc | Affected | ||
| Red Hat Enterprise Linux 9 | mod_auth_openidc | Affected |
Показывать по
Дополнительная информация
Статус:
EPSS
7.5 High
CVSS3
Связанные уязвимости
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
mod_auth_openidc is an OpenID Certified authentication and authorizati ...
EPSS
7.5 High
CVSS3