1. Forum
  2. Usenet
  3. LINUX.DEBIAN.ANNOUNCE.SEC

  • [SECURITY] [DSA 5405-1] libapache2-mod-auth-openidc security update

    From Moritz Muehlenhoff@21:1/5 to All on Thu May 18 15:20:01 2023
    -----BEGIN PGP SIGNED MESSAGE-----
    Hash: SHA512

    - ------------------------------------------------------------------------- Debian Security Advisory DSA-5405-1 security@debian.org https://www.debian.org/security/ Moritz Muehlenhoff
    May 18, 2023 https://www.debian.org/security/faq
    - -------------------------------------------------------------------------

    Package : libapache2-mod-auth-openidc
    CVE ID : CVE-2023-28625
    Debian Bug : 1033916

    It was discovered that missing input sanitising in the implementation
    of the OIDCStripCookie option in mod_auth_openidc could result in
    denial of service.

    For the stable distribution (bullseye), this problem has been fixed in
    version 2.4.9.4-0+deb11u3.

    We recommend that you upgrade your libapache2-mod-auth-openidc packages.

    For the detailed security status of libapache2-mod-auth-openidc please refer to its security tracker page at: https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

    Further information about Debian Security Advisories, how to apply
    these updates to your system and frequently asked questions can be
    found at: https://www.debian.org/security/

    Mailing list: debian-security-announce@lists.debian.org
    -----BEGIN PGP SIGNATURE-----

    iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmRmI/EACgkQEMKTtsN8 TjbcwQ//X8b4XxzVskGaPquONqmUjMN8ca0u/bEff7oguG9M+5MNDCWKY+8f6kyS R7xd7zn2hXJJh5/+fiHcd+tuvE5stMBjATm0Y2f77GypHjoNwTa+G6JYKRhUGqul b9CjiosjxtlmaSI2zsrnlVssckqqw56VdgCr7zZf8aw2yyxeZ0zeD81SujaScTm0 oqJ8Y5TQqrCzNldkmlSykZxjqQ6PPrpR/DrOXh5UB0i9YJqZWnz4ALib2rl4zJXt VQhPkSbOEn1gUnN1ypj5IjP74EaLx3ezrMqzMPMmKlNKOerDcHLy04C1dpwg8lET RFeT2JrFk9VYTriOjfbzTny55WubRZ3qQKCdoZWS8MwGcZfddt07iJ5746WOwmwp mlJ/9WTVR4uX/Z2IldVdfCiSEEOAYk5hQSAV1BGnTQVAlfPQlN50YyDQAxH7D4hs R5jBAbblsKyru9EnPrRIqNnYmoFbPoY1c+19LKGulCxtUyawH6gglkB3vq8+e9xv yGSjyrTzSCxmkU+RpEExtU3qQiS2NV/MCwCMR5kVYRdGA5SVScSnOJzCR3SoCr8Q WmhcCwWLqQCikuxtfmdSsYIHbIIG9XP1Lgwc4quGKD/f/JyySmW+odbIMdTjd61R DmFRpb+kRRL54tuexl+xbMSgPhIKMljdetCuoBUZacgJVDpW1Jw=
    =JOw9
    -----END PGP SIGNATURE-----

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)