Apache mod_auth_openidc Vulnerability: Denial of Service Attack Possible
CVE-2024-24814

7.5HIGH

Key Information:

Vendor

Openidc

Status
Mod Auth Openidc
Vendor
CVE Published:
13 February 2024

What is CVE-2024-24814?

The mod_auth_openidc module for the Apache 2.x HTTP server is susceptible to a vulnerability that arises from inadequate input validation on the mod_auth_openidc_session_chunks cookie. This flaw can be exploited to engineer Denial of Service (DoS) conditions, as large integer values, such as 99999999, can be used within the cookie, causing the server to enter a prolonged state of processing. This leads to server unresponsiveness and potential crashes with minimal attack effort, resulting in significant service disruption. The vulnerability has been resolved in version 2.4.15.2, and users are strongly recommended to upgrade to prevent exploitation. No workarounds are currently available.

Affected Version(s)

mod_auth_openidc >= 2.0.0, < 2.4.15.2

References

https://github.com/OpenIDC/mod_auth_openidc/security/advi...
x_refsource_CONFIRM
https://github.com/OpenIDC/mod_auth_openidc/commit/4022c1...
x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-ann...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.