Stay Secure with the Latest Linux Advisories

security advisorysecurity updatedebian

Debian 8: DLA-1647-1 Critical: Apache2 Session Management Issue

Diego Angulo from ImExHS discovered an issue in the webserver apache2. The module mod_session ignored the expiry time of sessions handled by mod_session_cookie, because the expiry time is available only after . Package : apache2 Version : 2.4.10-10+deb8u13 CVE ID : CVE-2018-17199 Diego Angulo from ImExHS discovered an issue in the webserver apache2. The module mod_session ignored the expiry time of sessions handled by mod_session_cookie, because the expiry time is available only after decoding the session and the check was already done before. For Debian 8 "Jessie", this problem has been fixed in version 2.4.10-10+deb8u13. We recommend that you upgrade your apache2 packages. Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Critical security advisory for Debian 8 addressing session management issue in apache2. Upgrade recommended!. apache2 Update, Debian Advisory, Session Security Issue. . Severity: Critical. LinuxSecurity.com Team

Jan 29, 2019 •Critical Debian LTS