Summary
cjose
[0.6.1-2]
- fix concatkdf big endian architecture problem.
Upstream issue #77.
[0.6.1-1]
- upgrade to latest upstream 0.6.1
[0.5.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild
[0.5.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild
[0.5.1-1]
- Initial packaging
mod_auth_openidc
[2.3.7-11]
- Resolves: rhbz#1987222 - CVE-2021-32792 XSS when using OIDCPreservePost On
[2.3.7-10]
- Resolves: rhbz#1987216 - CVE-2021-32791 hardcoded static IV and AAD with a
reused key in AES GCM encryption [rhel-8] (edit)
[2.3.7-9]
- Resolves: rhbz#2001853 - CVE-2021-39191 open redirect by supplying a crafted URL
in the target_link_uri parameter
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | cjose | 0:0.6.1-2.module+el8+5139+bcb28322 |
| Oracle Linux · 8 | cjose-devel | 0:0.6.1-2.module+el8+5139+bcb28322 |
| Oracle Linux · 8 | mod_auth_openidc | 0:2.3.7-11.module+el8.6.0+20572+b6f23e95 |
Vulnerabilities 4
-
Medium 5.9
Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encrypt…
-
Medium 4.7
Open Redirect in oidc_validate_redirect_url()
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` do…
-
Medium 4.7
URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO function…
-
Low 3.1
XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vul…