CVE-2024-24814 Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on modauthopenidcsessionchunks cookie value makes the server vulnerable to a...

CVE-2024-24814

CVE-2024-24814 affects the mod_auth_openidc OpenID Connect Relying Party module for Apache 2.x. The issue arises from missing input validation on the mod_auth_openidc_session_chunks cookie, which can be manipulated to a very large value, causing the server to work hard, delay responses, and poten...

CVE-2024-24814: Uncontrolled Resource Consumption

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on modauthopenidcsessionchunks cookie value makes the server vulnerable to a...

uC-HTTP Server Code Execution

The vulnerability of the HTTP server’s header parsing function on the uC-HTTP server is related to buffer overflow attacks. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

RLSA-2024:0387 Moderate: php:8.1 security update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: 1-byte array overrun in common path resolve code CVE-2023-0568 php: DoS vulnerability when parsing multipart request body CVE-2023-0662 php: Missing error check and insufficient random bytes...

php:8.1 security update

An update is available for php-pecl-zip, module.php-pecl-apcu, php-pecl-xdebug3, module.php-pecl-xdebug3, php-pecl-rrd, module.php-pecl-rrd, module.php-pecl-zip, php-pecl-apcu. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severit...

com.exactpro.th2:th2-cr-converter (>=1.3.0, <=1.3.1), com.slack.api:bolt-micronaut (>=1.16.0, <=1.27.3) +16 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (>=3.0.0-m3, <=3.8.0)

io.micronaut:micronaut-http-server-netty MAVEN version =3.0.0-m3, =1.3.0, =1.16.0, =0.1.0, =3.1.0, =3.0.0-m1, =3.0.0-m1, =3.0.0-m1, =1.0.0-m2, =3.8.0, =1.0.0-m1, =3.0.0-m3, =3.0.0-alpha5, =3.0.0-alpha5, =3.0.0-beta1 and more Source cves: CVE-2024-23639 Source advisory: OSV:GHSA-583G-G682-CRXF...

io.micronaut.configuration:micronaut-security-ldap (>=1.1.0, <=1.1.1), io.micronaut:micronaut-function-web (1.1.0) +8 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.1.0)

io.micronaut:micronaut-http-server MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - io.micronaut.configuration:micronaut-security-ldap =1.1.0, =1.1.0, =1.1.0, =1.1.0, =1.0.3,...

com.slack.api:bolt-micronaut (1.7.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (2.4.0)

io.micronaut:micronaut-http-server-netty MAVEN version 2.4.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 1.7.0 Source cves: CVE-2024-23639 Source advisory:...

com.slack.api:bolt-micronaut (1.7.1), io.micronaut.problem:micronaut-problem-json (1.0.0-m1) +3 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (2.4.1)

io.micronaut:micronaut-http-server MAVEN version 2.4.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.slack.api:bolt-micronaut 1.7.1 - io.micronaut.problem:micronaut-problem-json 1.0.0-m1 -...

com.bertramlabs.plugins:asset-pipeline-micronaut (>=3.0.9, <=3.2.5), io.micronaut.configuration:micronaut-security-ldap (1.1.0.m2) +7 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server (1.1.0.m2)

io.micronaut:micronaut-http-server MAVEN version 1.1.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut =3.0.9, =3.2.5 -...

com.bertramlabs.plugins:asset-pipeline-micronaut (3.0.7) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.0.1)

io.micronaut:micronaut-http-server-netty MAVEN version 1.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut 3.0.7 Source cves:...

com.bertramlabs.plugins:asset-pipeline-micronaut (>=3.0.9, <=3.2.5) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.1.0.m2)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.0.m2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.bertramlabs.plugins:asset-pipeline-micronaut =3.0.9, =3.2.5 Source cves:...

org.ryoframework.core:ryo-application-micronaut (>=1.0.3, <=1.0.9), org.ryoframework.next:ryo-adapter-micronaut (1.0.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.1.0)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - org.ryoframework.core:ryo-application-micronaut =1.0.3, =1.0.9 -...

org.ryoframework.core:ryo-application-micronaut (1.1.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.1.1)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - org.ryoframework.core:ryo-application-micronaut 1.1.0 Source cves: CVE-2024-236...

org.ryoframework.core:ryo-application-micronaut (>=1.1.1, <=1.3.1) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.1.2)

io.micronaut:micronaut-http-server-netty MAVEN version 1.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - org.ryoframework.core:ryo-application-micronaut =1.1.1, =1.3.1 Source cves:...

com.github.seratch:jslack-lightning-micronaut (>=3.1.1, <=3.4.2), net.javacrumbs.shedlock:shedlock-micronaut (>=4.0.0, <=4.8.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.2.6)

io.micronaut:micronaut-http-server-netty MAVEN version 1.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.github.seratch:jslack-lightning-micronaut =3.1.1, =4.0.0, =4.8.0 Source cve...

com.slack.api:bolt-micronaut (0.99.0) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.3.0)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut 0.99.0 Source cves: CVE-2024-23639 Source advisory...

com.slack.api:bolt-micronaut (>=0.99.1, <=1.0.2) potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.3.2)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut =0.99.1, =1.0.2 Source cves: CVE-2024-23639 Source...

com.slack.api:bolt-micronaut (>=1.0.3, <=1.0.6), info.novatec:micronaut-camunda-bpm-feature (>=0.1.0, <=0.2.2) +2 more potentially affected by CVE-2024-23639 via io.micronaut:micronaut-http-server-netty (1.3.3)

io.micronaut:micronaut-http-server-netty MAVEN version 1.3.3 is affected by a known vulnerability. The following packages have a transitive dependency on io.micronaut:micronaut-http-server-netty and may be impacted: - com.slack.api:bolt-micronaut =1.0.3, =0.1.0, =1.0.0.rc1, =1.0.0.rc2 -...