DEBIAN-CVE-2024-24814

    Dashboard / Vulnerabilities / DEBIAN-CVE-2024-24814

    DEBIAN-CVE-2024-24814

    Published: 13 Feb 2024Last Modified: 15 Sept 2026
    Upstream:
    CVE-2024-24814

    Summary:

    Details: mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.

    References: https://security-tracker.debian.org/tracker/CVE-2024-24814

    Affected packages

    Package

    Name: libapache2-mod-auth-openidc

    Purl: pkg:deb/debian/libapache2-mod-auth-openidc?arch=source&distro=bookworm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -2.4.12.3-2+deb12u1

    Affected versions

    2.4.12.3-2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    DEBIAN-CVE-2024-24814 | CVE-DB