Vigie VulnDBEuropean-hosted Vulnerability DB
EN
Menu

Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled (mod_auth_openidc)

CVE-2025-3891
HIGH 7.5

En bref

Source
NVD
EPSS
EPSS 1.58 % · centile 75 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
redhat
Statut NVD
Modified

Rechercher sur…

Description

A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.

Faiblesses (CWE)

  • CWE-248 — Exception non interceptée

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · secalert@redhat.com (Secondary)
CVSS 3.1HIGH 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HNVD · nvd@nist.gov (Secondary)

Références européennes

Configurations affectées (CPE NVD)

Produits affectés

ProduitVersions
mod_auth_openidcaffected 2.0.0 < 2.4.13.1
Red Hat · Red Hat Enterprise Linux 8unaffected 8100020250426100353.489197e6 < *
Red Hat · Red Hat Enterprise Linux 8.2 Advanced Update Supportunaffected 8020020250612174445.4cda2c84 < *
Red Hat · Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Supportunaffected 8040020250618101351.522a0ee4 < *
Red Hat · Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Supportunaffected 8060020250617090503.ad008a3a < *
Red Hat · Red Hat Enterprise Linux 8.6 Telecommunications Update Serviceunaffected 8060020250617090503.ad008a3a < *
Red Hat · Red Hat Enterprise Linux 8.6 Update Services for SAP Solutionsunaffected 8060020250617090503.ad008a3a < *
Red Hat · Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceunaffected 8080020250617090716.63b34585 < *
Red Hat · Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsunaffected 8080020250617090716.63b34585 < *
Red Hat · Red Hat Enterprise Linux 9unaffected 0:2.4.10-1.el9_6.2 < *
Red Hat · Red Hat Enterprise Linux 9.0 Update Services for SAP Solutionsunaffected 0:2.4.9.4-1.el9_0.3 < *
Red Hat · Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsunaffected 0:2.4.9.4-1.el9_2.3 < *
Red Hat · Red Hat Enterprise Linux 9.4 Extended Update Supportunaffected 0:2.4.9.4-4.el9_4.2 < *
Red Hat · Red Hat Enterprise Linux 10
Red Hat · Red Hat Enterprise Linux 7

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD