Threat database

A vulnerability in the mod_auth_openidc module for Apache HTTP Server allows OIDCProviderAuthRequestMethod POST requests to leak protected data. This affects Red Hat Enterprise Linux 10 and its extended update support versions. The issue is rated as important by Red Hat Product Security. An update addressing this vulnerability is available from Red Hat.

A denial of service (DoS) vulnerability (CVE-2024-24814) exists in the mod_auth_openidc Apache HTTP Server module when using the OIDCSessionType client-cookie configuration and manipulating cookies. This vulnerability affects Red Hat Enterprise Linux 8 versions of mod_auth_openidc. Red Hat has released an update to address this issue, which has been rated with moderate security impact. The vulnerability allows an attacker to cause a DoS condition by manipulating cookies. No known exploits in the wild have been reported.