CVE-2023-28625

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2023-28625
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L179 Third Party Advisory
https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a Patch
https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 Release Notes
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/ Release Notes
https://www.debian.org/security/2023/dsa-5405 Third Party Advisory
https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L179 Third Party Advisory
https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a Patch
https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 Release Notes
https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/ Release Notes
https://www.debian.org/security/2023/dsa-5405 Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:*
History

10 Apr 2025, 20:46

Type Values Removed Values Added
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/ - Release Notes

13 Feb 2025, 17:16

Type Values Removed Values Added
Summary (en) mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`. (en) mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using `OIDCStripCookies`.

21 Nov 2024, 07:55

Type Values Removed Values Added
References () https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L179 - Third Party Advisory () https://github.com/OpenIDC/mod_auth_openidc/blame/3f11976dab56af0a46a7dddb7a275cc16d6eb726/src/mod_auth_openidc.c#L178-L179 - Third Party Advisory
References () https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a - Patch () https://github.com/OpenIDC/mod_auth_openidc/commit/c0e1edac3c4c19988ccdc7713d7aebfce6ff916a - Patch
References () https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 - Release Notes () https://github.com/OpenIDC/mod_auth_openidc/releases/tag/v2.4.13.2 - Release Notes
References () https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr - Third Party Advisory () https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-f5xw-rvfr-24qr - Third Party Advisory
References () https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html - Third Party Advisory () https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html - Third Party Advisory
References () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/ - () https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/ -
References () https://www.debian.org/security/2023/dsa-5405 - Third Party Advisory () https://www.debian.org/security/2023/dsa-5405 - Third Party Advisory

31 May 2023, 20:15

Type Values Removed Values Added
CWE CWE-476
References
  • (MISC) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WIBKFC22PDH6UXMSZ23PHTD7736ZC7BB/ -

25 May 2023, 20:13

Type Values Removed Values Added
CPE cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:* cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:*
References (MISC) https://www.debian.org/security/2023/dsa-5405 - (MISC) https://www.debian.org/security/2023/dsa-5405 - Third Party Advisory
References (MISC) https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html - (MISC) https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html - Third Party Advisory

18 May 2023, 21:15

Type Values Removed Values Added
References
  • (MISC) https://www.debian.org/security/2023/dsa-5405 -

30 Apr 2023, 23:15

Type Values Removed Values Added
New CVE
Information

Published : 2023-04-03 14:15

Updated : 2025-04-10 20:46

NVD link : CVE-2023-28625

Mitre link : CVE-2023-28625

CVE.ORG link : CVE-2023-28625

JSON object : View

Products Affected

openidc

  • mod_auth_openidc
CWE
CWE-476

NULL Pointer Dereference