CVE-2024-24814
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-24814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2024-22186
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
EUVD-2024-22186- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
NVD
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-24814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVAZL-42520
CVE-2024-24814 affecting package mod_auth_openidc 2.4.14.2-1
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
AZL-42520- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVAZL-42537
CVE-2024-24814 affecting package mod_auth_openidc 2.4.14.2-2
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
AZL-42537- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
CVE-2024-24814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
Show 19 moreShow less
OSVDEBIAN-CVE-2024-24814
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
DEBIAN-CVE-2024-24814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1191
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-24814)
- Record
OESA-2024-1191- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1192
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-24814)
- Record
OESA-2024-1192- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1193
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-24814)
- Record
OESA-2024-1193- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2024-1194
mod_auth_openidc security update
This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).
Security Fix(es):
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.(CVE-2024-24814)
- Record
OESA-2024-1194- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:5289
Red Hat Security Advisory: mod_auth_openidc:2.3 security update
- Record
RHSA-2024:5289- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRHSA-2024:9180
Red Hat Security Advisory: mod_auth_openidc security update
- Record
RHSA-2024:9180- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVRLSA-2024:5289
Moderate: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS when using
OIDCSessionType client-cookieand manipulating cookies (CVE-2024-24814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
RLSA-2024:5289- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-24814
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In affected versions missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like 99999999, the server struggles with the request for a long time and finally gets back with a 500 error. Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- Record
UBUNTU-CVE-2024-24814- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVALSA-2024:5289 No score
Moderate: mod_auth_openidc:2.3 security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS when using
OIDCSessionType client-cookieand manipulating cookies (CVE-2024-24814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Record
ALSA-2024:5289- Updated
- 2026-11-02
OSVALSA-2024:9180 No score
Moderate: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS when using
OIDCSessionType client-cookieand manipulating cookies (CVE-2024-24814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
- Record
ALSA-2024:9180- Updated
- 2026-11-02
OSVCLSA-2025-1746655009 No score
mod_auth_openidc: Fix of CVE-2024-24814
- CVE-2024-24814: fix DoS when
OIDCSessionType client-cookieis set and a crafted Cookie header is supplied
- Record
CLSA-2025-1746655009- Updated
- 2026-11-02
OSVMGASA-2024-0081 No score
Updated apache-mod_auth_openidc packages fix security vulnerability
Missing input validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to DoS attack. (CVE-2024-24814)
- Record
MGASA-2024-0081- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13699-1 No score
apache2-mod_auth_openidc-2.4.15.3-1.1 on GA media
These are all security issues fixed in the apache2-mod_auth_openidc-2.4.15.3-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13699-1- Updated
- 2026-11-02
OSVRLSA-2024:9180 No score
Moderate: mod_auth_openidc security update
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
- mod_auth_openidc: DoS when using
OIDCSessionType client-cookieand manipulating cookies (CVE-2024-24814)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Rocky Linux 9.5 Release Notes linked from the References section.
- Record
RLSA-2024:9180- Updated
- 2026-11-02
OSVSUSE-SU-2024:0757-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2024-24814: Fixed a denial of service when using
OIDCSessionType client-cookieand manipulating cookies (bsc#1219911).
- Record
SUSE-SU-2024:0757-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:0758-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2024-24814: Fixed a denial of service when using
OIDCSessionType client-cookieand manipulating cookies (bsc#1219911).
- Record
SUSE-SU-2024:0758-1- Updated
- 2026-11-02
OSVSUSE-SU-2024:2299-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2024-24814: Fixed a bug that can led to DoS when
OIDCSessionType client-cookieis set and a crafted Cookie header is supplied. (bsc#1219911)
- Record
SUSE-SU-2024:2299-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4532-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- Update to 2.4.17.1 (bsc#1248806 / PED-14130).
- Remove many patches, as they've been merged upstream.
- Record
SUSE-SU-2025:4532-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
cjoseAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
cjoseAlmaLinux:8 |
before 0.6.1-4.module_el8.10.0+3881+234adf82 | 0.6.1-4.module_el8.10.0+3881+234adf82 |
cjose-develAlmaLinux:8 |
before 0.6.1-4.module_el8.9.0+3631+0ced13d7 | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
cjose-develAlmaLinux:8 |
before 0.6.1-4.module_el8.10.0+3881+234adf82 | 0.6.1-4.module_el8.10.0+3881+234adf82 |
mod_auth_openidcAlmaLinux:8 |
before 2.4.9.4-6.module_el8.10.0+3881+234adf82 | 2.4.9.4-6.module_el8.10.0+3881+234adf82 |
mod_auth_openidcAlmaLinux:9 |
before 2.4.10-1.el9 | 2.4.10-1.el9 |
mod_auth_openidcAzure Linux:2 |
through 2.4.14.2-1 | None known |
mod_auth_openidcAzure Linux:3 |
through 2.4.14.2-2 | None known |
mod_auth_openidcTuxCare:AlmaLinux:9.2 |
before 2.4.9.4-1.el9.tuxcare.els3 | 2.4.9.4-1.el9.tuxcare.els3 |
libapache2-mod-auth-openidcDebian:12 |
before 2.4.12.3-2+deb12u1, plus listed versions 2.4.12.3-2 |
2.4.12.3-2+deb12u1 |
Show 48 moreShow less
| Package | Affected | Fixed |
|---|---|---|
libapache2-mod-auth-openidcDebian:13 |
before 2.4.15.7-1 | 2.4.15.7-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.4.15.7-1 | 2.4.15.7-1 |
libapache2-mod-auth-openidcDebian:10 |
before 2.3.10.2-1+deb10u4, plus listed versions 2.3.10.2-12.3.10.2-1+deb10u12.3.10.2-1+deb10u22.3.10.2-1+deb10u3 |
2.3.10.2-1+deb10u4 |
apache-mod_auth_openidcMageia:9 |
before 2.4.13.2-1.1.mga9 | 2.4.13.2-1.1.mga9 |
mod_auth_openidcopenEuler:22.03-LTS |
before 2.4.15.3-1.oe2203 | 2.4.15.3-1.oe2203 |
mod_auth_openidcopenEuler:22.03-LTS-SP1 |
before 2.4.15.3-1.oe2203sp1 | 2.4.15.3-1.oe2203sp1 |
mod_auth_openidcopenEuler:22.03-LTS-SP2 |
before 2.4.15.3-1.oe2203sp2 | 2.4.15.3-1.oe2203sp2 |
mod_auth_openidcopenEuler:22.03-LTS-SP3 |
before 2.4.15.3-1.oe2203sp3 | 2.4.15.3-1.oe2203sp3 |
cjoseRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
cjose-develRed Hat:enterprise_linux:8::appstream |
before 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 | 0:0.6.1-4.module+el8.10.0+21813+b5444eb8 |
mod_auth_openidcRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-6.module+el8.10.0+21813+b5444eb8 | 0:2.4.9.4-6.module+el8.10.0+21813+b5444eb8 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-6.module+el8.10.0+21813+b5444eb8 | 0:2.4.9.4-6.module+el8.10.0+21813+b5444eb8 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:8::appstream |
before 0:2.4.9.4-6.module+el8.10.0+21813+b5444eb8 | 0:2.4.9.4-6.module+el8.10.0+21813+b5444eb8 |
mod_auth_openidcRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9 | 0:2.4.10-1.el9 |
mod_auth_openidc-debuginfoRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9 | 0:2.4.10-1.el9 |
mod_auth_openidc-debugsourceRed Hat:enterprise_linux:9::appstream |
before 0:2.4.10-1.el9 | 0:2.4.10-1.el9 |
cjoseRocky Linux:8 |
before 0:0.6.1-4.module+el8.9.0+1384+4b58c166 | 0:0.6.1-4.module+el8.9.0+1384+4b58c166 |
mod_auth_openidcRocky Linux:8 |
before 0:2.4.9.4-6.module+el8.10.0+1846+b7dcd2c3 | 0:2.4.9.4-6.module+el8.10.0+1846+b7dcd2c3 |
mod_auth_openidcRocky Linux:9 |
before 0:2.4.10-1.el9 | 0:2.4.10-1.el9 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP5 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP2-LTSS |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP3-LTSS |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 15 SP4-LTSS |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP2 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP3 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 15 SP4 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Manager Proxy 4.3 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Manager Server 4.3 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Enterprise Storage 7.1 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.5 |
before 2.3.8-150100.3.28.1 | 2.3.8-150100.3.28.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP5 |
before 2.4.0-7.12.2 | 2.4.0-7.12.2 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 12 SP5 |
before 2.4.0-7.12.2 | 2.4.0-7.12.2 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.3.8-150600.16.5.1 | 2.3.8-150600.16.5.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.3.8-150600.16.5.1 | 2.3.8-150600.16.5.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP7 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
libapache2-mod-auth-openidcUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-12.3.1-22.3.2-12.3.2-1build12.3.3-1build1 |
None known |
libapache2-mod-auth-openidcUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.10.2-12.4.0.4-12.4.1-1 |
None known |
libapache2-mod-auth-openidcUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.9-12.4.9.4-12.4.10-12.4.10-1build12.4.11-12.4.11-1ubuntu0.1 |
None known |
libapache2-mod-auth-openidcUbuntu:24.04:LTS |
All versions, plus listed versions 2.4.14.2-12.4.14.4-22.4.14.4-2build12.4.15.1-12.4.15.1-1build22.4.15.1-1build32.4.15.1-1ubuntu0.1 |
None known |
apache2-mod_auth_openidcopenSUSE:Tumbleweed |
before 2.4.15.3-1.1 | 2.4.15.3-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-24814 is a high vulnerability (CVSS 7.5) in Debian Linux, published February 13, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.25%, the 69th percentile. Fixed in cjose 0.6.1-4.module_el8.9.0+3631+0ced13d7.
References
github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-hxr6-w4gc-7vvv
lists.fedoraproject.org/archives/list/[email protected]/message/T7DKVEVREYAI4F46CQAVOTPL75WLOZOE
lists.debian.org/debian-lts-announce/2024/03/msg00004.html
access.redhat.com/errata/RHSA-2024:5289
Show 44 moreShow less
bugzilla.redhat.com/2264092
errata.almalinux.org/8/ALSA-2024-5289.html
nvd.nist.gov/vuln/detail/CVE-2024-24814
errata.tuxcare.com/almalinux9.2-esu/CLSA-2025-1746655009.html
security-tracker.debian.org/tracker/CVE-2024-24814
advisories.mageia.org/MGASA-2024-0081.html
bugs.mageia.org/show_bug.cgi?id=32928
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1191
issues.redhat.com/browse/RHEL-36492
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_5289.json
cve.org/CVERecord?id=CVE-2024-24814
docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/9.5_release_notes/index
errata.rockylinux.org/RLSA-2024:5289
suse.com/support/update/announcement/2024/suse-su-20240757-1
bugzilla.suse.com/1219911
ubuntu.com/security/CVE-2024-24814