Version in base suite: 2.4.17-1 Base version: libapache2-mod-auth-openidc_2.4.17-1 Target version: libapache2-mod-auth-openidc_2.4.17-1+deb13u1 Base file: /srv/ftp-master.debian.org/ftp/pool/main/liba/libapache2-mod-auth-openidc/libapache2-mod-auth-openidc_2.4.17-1.dsc Target file: /srv/ftp-master.debian.org/policy/pool/main/liba/libapache2-mod-auth-openidc/libapache2-mod-auth-openidc_2.4.17-1+deb13u1.dsc changelog | 6 ++++++ patches/CVE-2026-54789.patch | 19 +++++++++++++++++++ patches/series | 1 + 3 files changed, 26 insertions(+) dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpolxblamw/libapache2-mod-auth-openidc_2.4.17-1.dsc: no acceptable signature found dpkg-source: warning: cannot verify inline signature for /srv/release.debian.org/tmp/tmpolxblamw/libapache2-mod-auth-openidc_2.4.17-1+deb13u1.dsc: no acceptable signature found diff -Nru libapache2-mod-auth-openidc-2.4.17/debian/changelog libapache2-mod-auth-openidc-2.4.17/debian/changelog --- libapache2-mod-auth-openidc-2.4.17/debian/changelog 2025-04-22 09:57:49.000000000 +0000 +++ libapache2-mod-auth-openidc-2.4.17/debian/changelog 2026-09-13 18:43:51.000000000 +0000 @@ -1,3 +1,9 @@ +libapache2-mod-auth-openidc (2.4.17-1+deb13u1) trixie-security; urgency=medium + + * CVE-2026-54789 + + -- Moritz Mühlenhoff Sun, 13 Sep 2026 20:43:51 +0200 + libapache2-mod-auth-openidc (2.4.17-1) unstable; urgency=medium * New upstream version 2.4.17 diff -Nru libapache2-mod-auth-openidc-2.4.17/debian/patches/CVE-2026-54789.patch libapache2-mod-auth-openidc-2.4.17/debian/patches/CVE-2026-54789.patch --- libapache2-mod-auth-openidc-2.4.17/debian/patches/CVE-2026-54789.patch 1970-01-01 00:00:00.000000000 +0000 +++ libapache2-mod-auth-openidc-2.4.17/debian/patches/CVE-2026-54789.patch 2026-09-13 18:43:41.000000000 +0000 @@ -0,0 +1,19 @@ +From 8017478471cc071c49aa073c5c9be652a73a8630 Mon Sep 17 00:00:00 2001 +From: Hans Zandbelt +Date: Tue, 9 Jun 2026 22:31:35 +0200 +Subject: [PATCH] state: stop the state-cookie scan at the string terminator + +--- libapache2-mod-auth-openidc-2.4.17.orig/src/state.c ++++ libapache2-mod-auth-openidc-2.4.17/src/state.c +@@ -167,7 +167,10 @@ int oidc_state_cookies_clean_expired(req + cookie++; + if (_oidc_strstr(cookie, oidc_cfg_dir_state_cookie_prefix_get(r)) == cookie) { + cookieName = cookie; +- while (cookie != NULL && *cookie != OIDC_CHAR_EQUAL) ++ /* stop at the string terminator as well as at '='; the previous "cookie != NULL" condition could ++ * never be false (cookie is only incremented) so a state-prefixed token without a '=' would scan ++ * past the end of the buffer (out-of-bounds read, and a subsequent out-of-bounds NUL write) */ ++ while ((*cookie != '\0') && (*cookie != OIDC_CHAR_EQUAL)) + cookie++; + if (*cookie == OIDC_CHAR_EQUAL) { + *cookie = '\0'; diff -Nru libapache2-mod-auth-openidc-2.4.17/debian/patches/series libapache2-mod-auth-openidc-2.4.17/debian/patches/series --- libapache2-mod-auth-openidc-2.4.17/debian/patches/series 1970-01-01 00:00:00.000000000 +0000 +++ libapache2-mod-auth-openidc-2.4.17/debian/patches/series 2026-09-13 18:43:28.000000000 +0000 @@ -0,0 +1 @@ +CVE-2026-54789.patch