Most recent entries from all

ALSA-2022:1823 — Moderate: mod_auth_openidc:2.3 security update

Affected: AlmaLinux:8: cjose, AlmaLinux:8: cjose-devel, AlmaLinux:8: mod_auth_openidc

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

* mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)

* mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)

* mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)

* mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-01677

EUVD-2026-28122

fkie_cve-2021-32786

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.

gsd-2021-32786

msrc_CVE-2021-32786 — Open Redirect in oidc_validate_redirect_url()

msrc_CVE-2021-32786

openSUSE-SU-2021:1277-1 — Security update for apache2-mod_auth_openidc

Security update for apache2-mod_auth_openidc

SUSE-SU-2021:3020-1 — Security update for apache2-mod_auth_openidc

Security update for apache2-mod_auth_openidc

UBUNTU-CVE-2021-32786

Affected: Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc

WID-SEC-W-2023-0580 — Red Hat Enterprise Linux (mod_auth_openidc): Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um falsche Informationen darzustellen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting Angriff durchzuführen.