Back

HIGH

httpd: mod_session_cookie does not respect expiry time

Published Jan 30, 2019

Description

In Apache HTTP Server 2.4 release 2.4.37 and prior, mod_session checks the session expiry time before decoding the session. This causes session expiry time to be ignored for mod_session_cookie sessions since the expiry time is loaded when the session is decoded.

Affected products

Remediation

No remediation recorded yet.

Metrics

Weaknesses (2)

References (32)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner apache
Published Jan 30, 2019
Updated Sep 16, 2024
Reserved Sep 19, 2018
NVD
Status Modified
Modified Jun 17, 2026
Red Hat
Severity Moderate
Public date Jan 22, 2019