SUSE-SU-2024:0758-1: Security update for apache2-mod_auth_openidc

Published Mar 5, 2024

Updated

This update for apache2-modauthopenidc fixes the following issues: CVE-2024-24814: Fixed a denial of service when using OIDCSessionType client-cookie and manipulating cookies (bsc#1219911).

Affected Software

3 affected components

SUSE SUSE Linux Enterprise High Performance Computing 12 SP5 (aarch64 x86_64)

SUSE SUSE Linux Enterprise Server 12 SP5 (aarch64 ppc64le s390x x86_64)

SUSE SUSE Linux Enterprise Server for SAP Applications 12 SP5 (ppc64le x86_64)

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade apache2-mod_auth_openidc to a version that resolves this vulnerability.
Patch SUSE-SLE-SERVER-12-SP5-2024-758=1

Event History

Mar 5, 2024

Advisory Published

via SUSE·12:30 PM

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2024-24814

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Systems using apache2-mod_auth_openidc with OIDCSessionType set to client-cookie are affected. The update applies to SUSE Linux Enterprise 12 SP5 Server, High Performance Computing, and Server for SAP Applications on the listed architectures.

What does an attacker need to do to trigger the issue?

The issue is triggered by manipulating cookies in deployments that use client-cookie session storage. The provided information does not specify whether authentication or other access is required.

Is the default configuration affected?

The issue is specifically associated with OIDCSessionType client-cookie. The provided information does not state whether this is the default session type.

SUSE-SU-2024:0758-1: Security update for apache2-mod_auth_openidc

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

Is the default configuration affected?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

Is the default configuration affected?