Apache2 - Session Expiry Time Ignored in mod_session_cookie
Summary
DLA-1647-1: apache2 - security update. Affects apache2 versions < 2.4.10-10+deb8u13. Fixed in 2.4.10-10+deb8u13. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Apache2 is a widely used open-source web server software. It provides a robust and flexible platform for hosting websites and applications. The mod_session module in Apache2 allows for session management, enabling the server to maintain stateful connections with clients. However, a vulnerability has been discovered in the mod_session module that affects the handling of session expiry time when using mod_session_cookie.
Vulnerability Detail
The mod_session module in Apache2, specifically when used in conjunction with mod_session_cookie, fails to correctly handle the expiry time of sessions. The issue arises because the expiry time is only available after decoding the session, but the check for expiry is performed before decoding. As a result, the expiry time is ignored, allowing sessions to persist beyond their intended lifespan. This vulnerability could potentially lead to session hijacking or unauthorized access to sensitive information.
How To Fix
Minimum fixed version
2.4.10-10+deb8u13
This is the first release that contains the fix.
sudo apt-get install --only-upgrade apache2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the mod_session_cookie module and rely on other session management mechanisms provided by Apache2. This can be achieved by modifying the server configuration file and commenting out or removing the relevant lines that enable mod_session_cookie. However, it is important to note that this workaround may impact the functionality of applications relying on mod_session_cookie for session management.
Conclusion
In conclusion, the mod_session module in Apache2 is vulnerable to session expiry time being ignored when used with mod_session_cookie. This could potentially lead to session hijacking or unauthorized access to sensitive information. It is crucial to upgrade to Apache2 version 2.4.10-10+deb8u13 or later to mitigate this vulnerability. If you have any further questions or need assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for apache2 →
FAQ
The vulnerability allows sessions to persist beyond their intended expiry time, potentially leading to session hijacking or unauthorized access to sensitive information.
The vulnerability affects Apache2 version 2.4.10-10+deb8u12 and earlier. Later versions, starting from 2.4.10-10+deb8u13, include the necessary fixes.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your Apache2 installation is affected by this vulnerability. Simply upload your package-lock.json file and the Vulert Playground will analyze it for any known vulnerabilities.
Yes, a temporary workaround is to disable the mod_session_cookie module and rely on alternative session management mechanisms provided by Apache2. However, this workaround may impact the functionality of applications relying on mod_session_cookie.
You can find more information about Debian LTS security advisories, including how to apply updates and frequently asked questions, on the Debian LTS wiki: https://wiki.debian.org/LTS
Related vulnerabilities
Recent vulnerabilities recorded for apache2.
