CVE-2023-28625: mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied
modauthopenidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using OIDCStripCookies.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2023-28625?
CVE-2023-28625 is a vulnerability in mod_auth_openidc, an authentication and authorization module for the Apache 2.x HTTP server.
What is mod_auth_openidc?
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality.
What is the severity of CVE-2023-28625?
The severity of CVE-2023-28625 is high, with a CVSS score of 7.5.
How does CVE-2023-28625 affect mod_auth_openidc?
CVE-2023-28625 affects mod_auth_openidc versions 2.0.0 through 2.4.13.1.
How can CVE-2023-28625 be fixed?
The vulnerability can be fixed by upgrading mod_auth_openidc to version 2.4.13.2 or later.