-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Format: 1.8
Date: Thu, 18 Apr 2024 13:46:00 +0200
Source: libapache2-mod-auth-openidc
Architecture: source
Version: 2.4.15.7-1
Distribution: unstable
Urgency: medium
Maintainer: Moritz Schlarb <schlarbm@uni-mainz.de>
Changed-By: Moritz Schlarb <schlarbm@uni-mainz.de>
Closes: 1064183
Changes:
libapache2-mod-auth-openidc (2.4.15.7-1) unstable; urgency=medium
.
[ Hans Zandbelt ]
* update to OpenIDC Github repository/organization
.
[ Moritz Schlarb ]
* Bump Standards-Version
* New upstream version 2.4.15.7
* CVE-2024-24814: Missing input validation on mod_auth_openidc_session_chunks
cookie value made the server vulnerable to a Denial of Service (DoS)
attack. If an attacker manipulated the value of the OpenIDC cookie to a
very large integer like 99999999, the server struggled with the request for
a long time and finally returned a 500 error. Making a few requests of this
kind caused servers to become unresponsive, and so attackers could thereby
craft requests that would make the server work very hard and/or crash with
minimal effort. (Closes: #1064183)
Checksums-Sha1:
99e38667e5cbf3d57bdfa894f4591cf5a0a13e2c 2303 libapache2-mod-auth-openidc_2.4.15.7-1.dsc
7a3b80e65f4243fb7a958a262ac8d08e0473d09d 317784 libapache2-mod-auth-openidc_2.4.15.7.orig.tar.gz
cf9be9c7cbf4030844f47fd1c1ad1c0f0a78e76b 7588 libapache2-mod-auth-openidc_2.4.15.7-1.debian.tar.xz
997920d4d6f2ffb1d3f752c2efa7c3c815b1cc39 8866 libapache2-mod-auth-openidc_2.4.15.7-1_amd64.buildinfo
Checksums-Sha256:
eb67c0732a7d4f059da9234eb8460004852b069836c3b42a57b47de46f2ff344 2303 libapache2-mod-auth-openidc_2.4.15.7-1.dsc
672a7a483f28314372e33ad48a501c5cb8aac40c5a9c921ea962e7e2c11ab807 317784 libapache2-mod-auth-openidc_2.4.15.7.orig.tar.gz
0eee50cf955f1c07c05071945c14a841df83f09b6beb49131b0ae2bfbac7865d 7588 libapache2-mod-auth-openidc_2.4.15.7-1.debian.tar.xz
cade656c2a13892b465472aa06f2cdcc419dd3259688bee919d5f400679926c6 8866 libapache2-mod-auth-openidc_2.4.15.7-1_amd64.buildinfo
Files:
2185caf1e85847bb9382070f358002d8 2303 httpd optional libapache2-mod-auth-openidc_2.4.15.7-1.dsc
1161b07162a9b930dd3f0bc9bec05a9f 317784 httpd optional libapache2-mod-auth-openidc_2.4.15.7.orig.tar.gz
f671e9c783143c4e158784cf55065af0 7588 httpd optional libapache2-mod-auth-openidc_2.4.15.7-1.debian.tar.xz
d1ca7a5fec5a63fd93d417204e764639 8866 httpd optional libapache2-mod-auth-openidc_2.4.15.7-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----
iQJKBAEBCgA0FiEE3wEiR7/GVQGv8oRFDCS4Qcfduq8FAmYhCHAWHHNjaGxhcmJt
QHVuaS1tYWluei5kZQAKCRAMJLhBx926r0FMEACqE3ut/RuQjCMoeT+sUkMfWqOy
9I33i5HKbWWGrNcjx1a91SckGEFHkDiR+SfoyTNAF7aJ1FvAeXKPTJjH58DKXAa4
eQG+ti0KedQEoN5l5kUyR1922Vl6nIFlMoQ0K+f0evdHQQ/CIja3DUZOPiIb879W
az+rpIZv1PFjuF+MDmkl50/ysoj8QjT+M98e3M3D9Nh2iSREainYMWH4oHpKuUfP
PGcZa8NeOfPY4hoG8fN61nzWiXMaNX8bQQJ7h5xX2sHYvKb+syKgrTOFyi+uzaWI
evgrdytz2NLCHiTw/lc6VFAF0jg2sn5YIcr3Td25TJPJFfZf3uCVPZs7xjGGAr5Q
HezmbkzBevKULNin2DFhKVhnDYW5fZXpRpO/boGuLvoli9DVOU8N1My9c+1x9A3i
45VX7OmShN2bm6G4i+Kw9C3hGntVuzVggF1GVyGBFhlZ2J+sDlkiStEnaE4o2h3W
kKuMs4IyQB29xvRWb3kbxPnoo6fyiZJczPPck/YgTZppOnQKd+oP4ox0POmFo2aY
w7+3rOrG7kv5G3Zi2yXJBKZiNdV+/Es+PQ88UtrVl7e+AyNNQGuyKSfCmIz4wH4+
xQwTEPNE6EB77VjVovuj8d3QMCFI0Wc0p5hucF0wrbX6PPnXMyvpyCHqUCt8UBEj
csbkQZki9ZpyPVHi0w==
=TsXQ
-----END PGP SIGNATURE-----
Attachment:
pgpeDS_pEGzJ4.pgp
Description: PGP signature