it-securitynotifies AT lists.piratenpartei.de
Betreff: Sicherheitsankündigungen
Listenarchiv
[IT-SecNots] [SECURITY] [DSA 5405-1] libapache2-mod-auth-openidc security update
Chronologisch Thread
- From: Moritz Muehlenhoff <jmm AT debian.org>
- To: debian-security-announce AT lists.debian.org
- Subject: [IT-SecNots] [SECURITY] [DSA 5405-1] libapache2-mod-auth-openidc security update
- Date: Thu, 18 May 2023 13:12:35 +0000
- Authentication-results: mail.piratenpartei.de; dkim=none; spf=none (mail.piratenpartei.de: domain of "bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org" has no SPF policy when checking 2001:41b8:202:deb:216:36ff:fe40:4002) smtp.mailfrom="bounce-debian-security-announce=it-securitynotifies=lists.piratenpartei.de AT lists.debian.org"; dmarc=none
- List-archive: https://lists.debian.org/msgid-search/ZGYkQ7a98XKCCs9m AT seger.debian.org
- List-id: <debian-security-announce.lists.debian.org>
- List-url: <http://lists.debian.org/debian-security-announce/>
- Old-dkim-signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=debian.org; s=smtpauto.seger; h=Content-Type:MIME-Version:Message-ID:Subject:To:From:Date :Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description: In-Reply-To:References; bh=gf97iOzIMsAciLw7DqvOw15CN2NCN/8DPdu0B7gTdj8=; b=Ga FnQ+TJ1vFRibL+Mj8ueHMYYELdEXDZXYTZ61rRq6/Txg8YoCiC6mGkDkxfbPc9L90iHe7qa0HQy3K H0Nbsd92Hl6HIw7K7rxcx6yB3+l3MhpEE6P0Wm2xvRZ9W6sO4g2nL4fVX53dsseuuLmMRZxKGbaIX ZGZAo3iJISs/f8Mu7oqDQPLpczvZzPE5yNlDwf45DPqPGC4xV2+ubWaKwmsGfGvfcFy8JaWuRsidV 0OXSf40JzqoxQQ84oD9IB2bZcMU6Rruswuguse+R5rKPupD6k5qDDK0JnNXlfSSv3eeAkFW1p2vyk gC2eV4J1jhLo7IaVKKVpDEpCmH05Mmmg==;
- Old-return-path: <jmm AT seger.debian.org>
- Priority: urgent
- Resent-date: Thu, 18 May 2023 13:12:59 +0000 (UTC)
- Resent-from: debian-security-announce AT lists.debian.org
- Resent-message-id: <dTL07KDLIlF.A.d5G.bRiZkB@bendel>
- Resent-sender: debian-security-announce-request AT lists.debian.org
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian Security Advisory DSA-5405-1 security AT debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
May 18, 2023 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : libapache2-mod-auth-openidc
CVE ID : CVE-2023-28625
Debian Bug : 1033916
It was discovered that missing input sanitising in the implementation
of the OIDCStripCookie option in mod_auth_openidc could result in
denial of service.
For the stable distribution (bullseye), this problem has been fixed in
version 2.4.9.4-0+deb11u3.
We recommend that you upgrade your libapache2-mod-auth-openidc packages.
For the detailed security status of libapache2-mod-auth-openidc please refer
to
its security tracker page at:
https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Mailing list: debian-security-announce AT lists.debian.org
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmRmI/EACgkQEMKTtsN8
TjbcwQ//X8b4XxzVskGaPquONqmUjMN8ca0u/bEff7oguG9M+5MNDCWKY+8f6kyS
R7xd7zn2hXJJh5/+fiHcd+tuvE5stMBjATm0Y2f77GypHjoNwTa+G6JYKRhUGqul
b9CjiosjxtlmaSI2zsrnlVssckqqw56VdgCr7zZf8aw2yyxeZ0zeD81SujaScTm0
oqJ8Y5TQqrCzNldkmlSykZxjqQ6PPrpR/DrOXh5UB0i9YJqZWnz4ALib2rl4zJXt
VQhPkSbOEn1gUnN1ypj5IjP74EaLx3ezrMqzMPMmKlNKOerDcHLy04C1dpwg8lET
RFeT2JrFk9VYTriOjfbzTny55WubRZ3qQKCdoZWS8MwGcZfddt07iJ5746WOwmwp
mlJ/9WTVR4uX/Z2IldVdfCiSEEOAYk5hQSAV1BGnTQVAlfPQlN50YyDQAxH7D4hs
R5jBAbblsKyru9EnPrRIqNnYmoFbPoY1c+19LKGulCxtUyawH6gglkB3vq8+e9xv
yGSjyrTzSCxmkU+RpEExtU3qQiS2NV/MCwCMR5kVYRdGA5SVScSnOJzCR3SoCr8Q
WmhcCwWLqQCikuxtfmdSsYIHbIIG9XP1Lgwc4quGKD/f/JyySmW+odbIMdTjd61R
DmFRpb+kRRL54tuexl+xbMSgPhIKMljdetCuoBUZacgJVDpW1Jw=
=JOw9
-----END PGP SIGNATURE-----
- [IT-SecNots] [SECURITY] [DSA 5405-1] libapache2-mod-auth-openidc security update, Moritz Muehlenhoff, 18.05.2023
Archiv bereitgestellt durch MHonArc 2.6.24.