CVE-2024-24814

CVE-2024-24814 affects the mod_auth_openidc OpenID Connect Relying Party module for Apache 2.x. The issue arises from missing input validation on the mod_auth_openidc_session_chunks cookie, which can be manipulated to a very large value, causing the server to work hard, delay responses, and poten...

uC-HTTP Server Code Execution

The vulnerability of the HTTP server’s header parsing function on the uC-HTTP server is related to buffer overflow attacks. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2024-24814: Uncontrolled Resource Consumption

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on modauthopenidcsessionchunks cookie value makes the server vulnerable to a...

RLSA-2024:0387 Moderate: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: DoS vulnerability when parsing multipart request body CVE-2023-0662 php: Missing error check and insufficient random bytes...

php:8.1 security update

An update is available for php-pecl-zip, module.php-pecl-apcu, php-pecl-xdebug3, module.php-pecl-xdebug3, php-pecl-rrd, module.php-pecl-rrd, module.php-pecl-zip, php-pecl-apcu. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

io.micronaut:micronaut-function-web (2.0.0.rc2), io.micronaut:micronaut-http-server-netty (2.0.0.rc2) +1 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.0.0.rc2)

io.micronaut:micronaut-http-server MAVEN version 2.0.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut:micronaut-function-web 2.0.0.rc2 - io.micronaut:micronaut-http-server-nett...

com.slack.api:bolt-micronaut (1.8.1), io.micronaut.graphql:micronaut-graphql (>=2.3.0, <=2.3.1) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.5.4)

io.micronaut:micronaut-http-server MAVEN version 2.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.slack.api:bolt-micronaut 1.8.1 - io.micronaut.graphql:micronaut-graphql =2.3.0, =2.3.1 ...

io.micronaut.configuration:micronaut-security-ldap (>=1.1.0, <=1.1.1), io.micronaut:micronaut-function-web (1.1.0) +8 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.1.0)

io.micronaut:micronaut-http-server MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.0.3,...

io.micronaut.configuration:micronaut-security-ldap (1.1.0.rc2), io.micronaut:micronaut-function-web (1.1.0.rc2) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.1.0.rc2)

io.micronaut:micronaut-http-server MAVEN version 1.1.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap 1.1.0.rc2 -...

io.micronaut.configuration:micronaut-security-ldap (1.1.0.rc1), io.micronaut:micronaut-function-web (1.1.0.rc1) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.1.0.rc1)

io.micronaut:micronaut-http-server MAVEN version 1.1.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap 1.1.0.rc1 -...

com.bertramlabs.plugins:asset-pipeline-micronaut (>=3.0.9, <=3.2.5), io.micronaut.configuration:micronaut-security-ldap (1.1.0.m2) +7 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.1.0.m2)

io.micronaut:micronaut-http-server MAVEN version 1.1.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut =3.0.9, =3.2.5 -...

io.micronaut.configuration:micronaut-security-ldap (1.1.0.m1), io.micronaut:micronaut-function-web (1.1.0.m1) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.1.0.m1)

io.micronaut:micronaut-http-server MAVEN version 1.1.0.m1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap 1.1.0.m1 -...

io.micronaut.configuration:micronaut-security-ldap (1.0.5), io.micronaut:micronaut-function-web (1.0.5) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.5)

io.micronaut:micronaut-http-server MAVEN version 1.0.5 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap 1.0.5 -...

io.micronaut.aws:micronaut-function-aws-api-proxy (>=1.1.0.m2, <=1.1.2), io.micronaut.aws:micronaut-function-aws-custom-runtime (>=1.1.0.m2, <=1.1.1) +11 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.4)

io.micronaut:micronaut-http-server MAVEN version 1.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.aws:micronaut-function-aws-api-proxy =1.1.0.m2, =1.1.0.m2, =1.1.0.rc2,...

io.micronaut.configuration:micronaut-multitenancy-gorm (1.0.3), io.micronaut.configuration:micronaut-security-ldap (1.0.3) +7 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.3)

io.micronaut:micronaut-http-server MAVEN version 1.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-multitenancy-gorm 1.0.3 -...

com.bertramlabs.plugins:asset-pipeline-micronaut (3.0.7), io.micronaut.configuration:micronaut-multitenancy-gorm (1.0.1) +8 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.1)

io.micronaut:micronaut-http-server MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut 3.0.7 -...

io.micronaut.configuration:micronaut-multitenancy-gorm (1.0.0), io.micronaut.configuration:micronaut-security-ldap (1.0.0) +6 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.0)

io.micronaut:micronaut-http-server MAVEN version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-multitenancy-gorm 1.0.0 -...

io.micronaut.configuration:micronaut-multitenancy-gorm (1.0.0.rc3), io.micronaut.configuration:micronaut-security-ldap (1.0.0.rc3) +7 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.0.0.rc3)

io.micronaut:micronaut-http-server MAVEN version 1.0.0.rc3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-multitenancy-gorm 1.0.0.rc3 -...

com.slack.api:bolt-micronaut (1.7.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.4.0)

io.micronaut:micronaut-http-server-netty MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 1.7.0 Source cves: CVE-2024-23639 Source advisory:...

net.javacrumbs.shedlock:shedlock-micronaut (4.21.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.3.4)

io.micronaut:micronaut-http-server-netty MAVEN version 2.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - net.javacrumbs.shedlock:shedlock-micronaut 4.21.0 Source cves: CVE-2024-23639...