Most recent entries from all

ALSA-2022:1823 — Moderate: mod_auth_openidc:2.3 security update

Affected: AlmaLinux:8: cjose, AlmaLinux:8: cjose-devel, AlmaLinux:8: mod_auth_openidc

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

* mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)

* mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)

* mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)

* mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2022-01657

EUVD-2026-28216

fkie_cve-2021-32791

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

gsd-2021-32791

msrc_CVE-2021-32791 — Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

msrc_CVE-2021-32791

openSUSE-SU-2021:1277-1 — Security update for apache2-mod_auth_openidc

Security update for apache2-mod_auth_openidc

SUSE-SU-2021:3020-1 — Security update for apache2-mod_auth_openidc

Security update for apache2-mod_auth_openidc

UBUNTU-CVE-2021-32791

Affected: Ubuntu:18.04:LTS: libapache2-mod-auth-openidc, Ubuntu:20.04:LTS: libapache2-mod-auth-openidc

WID-SEC-W-2023-0580 — Red Hat Enterprise Linux (mod_auth_openidc): Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um falsche Informationen darzustellen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting Angriff durchzuführen.