Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2023:1849-1

Опубликовано: 14 апр. 2023
Источник: suse-cvrf

Описание

Security update for apache2-mod_auth_openidc

This update for apache2-mod_auth_openidc fixes the following issues:

  • CVE-2023-28625: Fixed NULL pointer dereference when OIDCStripCookies was set and a crafted Cookie header was supplied (bsc#1210073).

Список пакетов

SUSE Enterprise Storage 7
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Enterprise Storage 7.1
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise High Performance Computing 15 SP3-ESPOS
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Module for Server Applications 15 SP4
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Real Time 15 SP3
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Server 15 SP1-LTSS
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Server 15 SP2-LTSS
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Server 15 SP3-LTSS
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Server for SAP Applications 15 SP1
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise Server for SAP Applications 15 SP3
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Manager Proxy 4.2
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Manager Server 4.2
apache2-mod_auth_openidc-2.3.8-150100.3.25.1
openSUSE Leap 15.4
apache2-mod_auth_openidc-2.3.8-150100.3.25.1

Ссылки

Описание

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.

Затронутые продукты
SUSE Enterprise Storage 7.1:apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Enterprise Storage 7:apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS:apache2-mod_auth_openidc-2.3.8-150100.3.25.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:apache2-mod_auth_openidc-2.3.8-150100.3.25.1
Ссылки
Уязвимость SUSE-SU-2023:1849-1