Release date:
2026-10-09 15:12:04 UTC
Description:
* SECURITY UPDATE: one-time nonce replay and use-after-free in
mod_auth_digest
- debian/patches/CVE-2026-73636_CVE-2026-73637.patch: accept a
one-time nonce or nonce-count only when it is newer than the one
last recorded for the client, and send a stale challenge when the
client entry is no longer known, in client_update_nonce() called
from check_and_record_nonce(); access client entries only while
holding client_lock, in modules/aaa/mod_auth_digest.c.
AuthDigestQop now accepts only "auth", and requests without
qop=auth are rejected.
- CVE-2026-73636
- CVE-2026-73637
Updated packages:
-
apache2_2.4.18-2ubuntu3.17+tuxcare.els28_amd64.deb
sha:a1e6ec01ef2f0633023b5fdb9348ebab853acbba
-
apache2-bin_2.4.18-2ubuntu3.17+tuxcare.els28_amd64.deb
sha:a82daf7370feae07b21f06b5f79ded8c3a62de2b
-
apache2-data_2.4.18-2ubuntu3.17+tuxcare.els28_all.deb
sha:5cf8c39402e55b3abb76442700b5ec8b8cefe983
-
apache2-dev_2.4.18-2ubuntu3.17+tuxcare.els28_amd64.deb
sha:319703828d47a53da47f5b2bef2db0bb92bc537a
-
apache2-doc_2.4.18-2ubuntu3.17+tuxcare.els28_all.deb
sha:a3b0eaae487a6ce4301077ae40e6115d1abdf067
-
apache2-suexec-custom_2.4.18-2ubuntu3.17+tuxcare.els28_amd64.deb
sha:92ef3b5a12cb4d1851acc295d965257dc60b9789
-
apache2-suexec-pristine_2.4.18-2ubuntu3.17+tuxcare.els28_amd64.deb
sha:da813008bac7ba849cacb75d1f18d0da96424c87
-
apache2-utils_2.4.18-2ubuntu3.17+tuxcare.els28_amd64.deb
sha:81dff88f5a1cd9598253698b44bbe79b5c1cd301
Notes:
This page is generated automatically and has not been checked for errors. For clarification or
corrections please contact the
CloudLinux Packaging Team.
