Summary
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
Security Fix(es):
* mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)
* mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied (CVE-2023-28625)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux · 8 | cjose | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
| AlmaLinux · 8 | cjose-devel | 0.6.1-4.module_el8.9.0+3631+0ced13d7 |
| AlmaLinux · 8 | mod_auth_openidc | 2.4.9.4-5.module_el8.9.0+3631+0ced13d7 |
Vulnerabilities 2
-
High 7.5
mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a N…
-
Medium 4.7
Open Redirect in oidc_validate_redirect_url()
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_valid…
References
-
report
https://access.redhat.com/security/cve/CVE-2022-23527
-
report
https://access.redhat.com/security/cve/CVE-2023-28625
-
report
https://bugzilla.redhat.com/2072469
-
report
https://bugzilla.redhat.com/2141850
-
report
https://bugzilla.redhat.com/2153655
-
report
https://bugzilla.redhat.com/2184118
-
advisory
https://errata.almalinux.org/8/ALSA-2023-6940.html