SUSE-SU-2024:0757-1: Security update for apache2-mod_auth_openidc

Published Mar 5, 2024

Updated

This update for apache2-modauthopenidc fixes the following issues: CVE-2024-24814: Fixed a denial of service when using OIDCSessionType client-cookie and manipulating cookies (bsc#1219911).

Affected Software

16 affected components

SUSE SUSE Manager Proxy 4.3 (x86_64)

SUSE SUSE Manager Retail Branch Server 4.3 (x86_64)

SUSE SUSE Manager Server 4.3 (ppc64le s390x x86_64)

SUSE SUSE Enterprise Storage 7.1 (aarch64 x86_64)

SUSE openSUSE Leap 15.5 (aarch64 ppc64le s390x x86_64)

SUSE Server Applications Module 15-SP5 (aarch64 ppc64le s390x x86_64)

SUSE SUSE Linux Enterprise High Performance Computing 15 SP2 LTSS 15-SP2 (aarch64 x86_64)

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP3 (aarch64 x86_64)

SUSE SUSE Linux Enterprise High Performance Computing ESPOS 15 SP4 (aarch64 x86_64)

SUSE SUSE Linux Enterprise High Performance Computing LTSS 15 SP4 (aarch64 x86_64)

SUSE SUSE Linux Enterprise Server 15 SP2 LTSS 15-SP2 (aarch64 ppc64le s390x x86_64)

SUSE SUSE Linux Enterprise Server 15 SP3 LTSS 15-SP3 (aarch64 ppc64le s390x x86_64)

SUSE SUSE Linux Enterprise Server 15 SP4 LTSS 15-SP4 (aarch64 ppc64le s390x x86_64)

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP2 (ppc64le x86_64)

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP3 (ppc64le x86_64)

SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP4 (ppc64le x86_64)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Module-Server-Applications-15-SP5-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP2-LTSS-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP3-LTSS-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-ESPOS-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-HPC-15-SP4-LTSS-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP2-LTSS-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP3-LTSS-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES-15-SP4-LTSS-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP2-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP3-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SLES_SAP-15-SP4-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Proxy-4.3-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Retail-Branch-Server-4.3-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-SLE-Product-SUSE-Manager-Server-4.3-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch SUSE-Storage-7.1-2024-757=1
Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch openSUSE-SLE-15.5-2024-757=1

Event History

Mar 5, 2024

Advisory Published

via SUSE·12:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-24814

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

The issue affects deployments using apache2-mod_auth_openidc with OIDCSessionType configured as client-cookie. The advisory lists SUSE Manager Proxy 4.3, SUSE Manager Retail Branch Server 4.3, SUSE Manager Server 4.3, SUSE Enterprise Storage 7.1, openSUSE Leap 15.5, Server Applications Module 15-SP5, and specified SLE HPC LTSS releases.

What does an attacker need to do to trigger the issue?

The denial of service is triggered by manipulating cookies in an environment using client-cookie OIDC sessions. The provided advisory does not state that authentication or local access is required.

Is the default session configuration known to be affected?

The advisory identifies OIDCSessionType client-cookie as the affected configuration. It does not state whether client-cookie is the default setting.

What can be done if the update cannot be installed immediately?

The provided information identifies client-cookie session handling as the affected condition. It does not provide a documented workaround or mitigation.

SUSE-SU-2024:0757-1: Security update for apache2-mod_auth_openidc

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

Is the default session configuration known to be affected?

What can be done if the update cannot be installed immediately?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

Is the default session configuration known to be affected?

What can be done if the update cannot be installed immediately?