JVN#65559247: OpenAM vulnerable to denial-of-service (DoS)

OpenAM provided by ForgeRock is an open source access management software. OpenAM contains a denial-of-service (DoS) vulnerability due to a flaw in processing Cookies (CWE-400).

Impact

When an OpenAM system is running “site” configuration with multiple instances, an authenticated attacker may be able to cause a denial-of-service (DoS).

Solution

Apply a Patch
Apply the appropriate patch according to the information provided by the developer.

Products Affected

• OpenAM 9.5.3-9.5.5, 10.0.0-10.0.2, 10.1.0-Xpress, 11.0.0-11.0.2