Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
Apache HTTP Server NULL Pointer Dereference Vulnerability - CVE-2023-28625 - Vulnerability Database
Apache HTTP Server

Apache HTTP Server NULL Pointer Dereference Vulnerability - CVE-2023-28625

High
Reference: CVE-2023-28625
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2023-28625
Title: Apache HTTP Server NULL Pointer Dereference Vulnerability
Overview:

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1 when OIDCStripCookies is set and a crafted cookie supplied a NULL pointer dereference would occur resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround avoid using OIDCStripCookies.