Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.debian.changes > #11536
| From | Debian FTP Masters <ftpmaster@ftp-master.debian.org> |
|---|---|
| Newsgroups | linux.debian.changes |
| Subject | Accepted libapache2-mod-auth-openidc 2.4.9.4-0+deb11u4 (source) into oldstable-proposed-updates |
| Date | 2024-04-22 22:40 +0200 |
| Message-ID | <Iw8Cd-8acP-17@gated-at.bofh.it> (permalink) |
| Organization | linux.* mail to news gateway |
[Multipart message — attachments visible in raw view] - view raw
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 18 Apr 2024 14:27:26 +0200
Source: libapache2-mod-auth-openidc
Architecture: source
Version: 2.4.9.4-0+deb11u4
Distribution: bullseye
Urgency: high
Maintainer: Moritz Schlarb <schlarbm@uni-mainz.de>
Changed-By: Moritz Schlarb <schlarbm@uni-mainz.de>
Closes: 1064183
Changes:
libapache2-mod-auth-openidc (2.4.9.4-0+deb11u4) bullseye; urgency=high
.
* CVE-2024-24814: Missing input validation on mod_auth_openidc_session_chunks
cookie value made the server vulnerable to a Denial of Service (DoS)
attack. If an attacker manipulated the value of the OpenIDC cookie to a
very large integer like 99999999, the server struggled with the request for
a long time and finally returned a 500 error. Making a few requests of this
kind caused servers to become unresponsive, and so attackers could thereby
craft requests that would make the server work very hard and/or crash with
minimal effort. (Closes: #1064183)
Checksums-Sha1:
59075b190efed8b5b0acc91beb6719f72950f871 2560 libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4.dsc
c2547eb068c4cf808254e22084bf38863ed65927 8180 libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4.debian.tar.xz
5b57962345ba44d775627aa58e67c23270996c32 8775 libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4_amd64.buildinfo
Checksums-Sha256:
fdfdf2d1e8f29d9aeecc447f752f9d6c8fd197a17f41e9928bb0c9520cbc6095 2560 libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4.dsc
e180e64cb72b19bbb55a9b17ee6c9b6157b6ee79b0e38fee4f3af08be0de9656 8180 libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4.debian.tar.xz
7163bc3c51b761633c1dee6881d715342daad6817f4afad1c9d7093765ada122 8775 libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4_amd64.buildinfo
Files:
db3f551e27cc7eb67b79ae17934e027b 2560 httpd optional libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4.dsc
e6225a8e4af69e90ca7ed50d884358a6 8180 httpd optional libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4.debian.tar.xz
645b146646668d77485825efad8fcb2a 8775 httpd optional libapache2-mod-auth-openidc_2.4.9.4-0+deb11u4_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJKBAEBCgA0FiEE3wEiR7/GVQGv8oRFDCS4Qcfduq8FAmYhEhAWHHNjaGxhcmJt
QHVuaS1tYWluei5kZQAKCRAMJLhBx926r+JaEACGpXKn4dQQBUzRzfHpy7I+h6d+
KhrZkahzHob6pesxyOhW6d+mbBYyaqzk7HTprOo1Xtu0mr5AvPnyJPkQQdoG6nmb
COTbSyuIOKtykC28eTjm9nqcECm4NCNhCKeNocS0HXJr8juQvbmR6tb0u1sQt/WY
nmrK1RPJFb7VaJw5lwVcCOUgFLD6SCfglVOxORFkmiU6btxM/soJvATYzDW4hPY8
z2awnGK4oQrREYB61OhbxvzS6aEfpPNWVcrGxlHsDXbKjcjq/DsnEcxN/1TVnjYR
ehVKJjKhRL/sqsn5xoWPr3Yd2i4KsW7yXEmW6St3RvW5fhoL4ufAfWFFCYB3TX8r
AlQZSaoW+kxuAVTlNp3X4syIibzOsRRq/TVRIFNkwFjCDMmKARARSmbg//NoVQqD
2/PYRjFr4WtDFqfnezGGtQHwocoRGDxlyD+FDTjmZq676E5vexpq1s6Dy5Pz6BJE
00Onbmqn8dN23ojD+SdKYwR2CQbLIkpnXx0voa5Hd7EeqqPdeKm1jmuEQjlSJM0T
JQ8z4TBJvffeUCC7XxvHo/w3a5fVOipIcpg9VpQd+Bh2Of06Jk2W8Cr4yi1AW5Kx
T1Pi0+a/q50JSeobrSpHgTRnW9ikhb0clFpAe445wEV70529ncFUmfG0CNS6PmaE
3ujZ3jN+aB2PDK6dxA==
=buzI
-----END PGP SIGNATURE-----
Back to linux.debian.changes | Previous | Next | Find similar | Unroll thread
Accepted libapache2-mod-auth-openidc 2.4.9.4-0+deb11u4 (source) into oldstable-proposed-updates Debian FTP Masters <ftpmaster@ftp-master.debian.org> - 2024-04-22 22:40 +0200
csiph-web