Summary
cjose
[0.6.1-4]
- CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual
Authentication Tag provided in the JWE
Resolves: rhbz#2223308
mod_auth_openidc
[2.4.9.4-5]
Related: rhbz#2141850 - fix cjose version dependency
[2.4.9.4-4]
Resolves: rhbz#2141850 - auth_openidc.conf mode 0640 by default
[2.4.9.4-3]
- Resolves: rhbz#2184144 - CVE-2023-28625 NULL pointer dereference
when OIDCStripCookies is set and a crafted Cookie header is supplied
[2.4.9.4-2]
- Resolves: rhbz#2153659 - CVE-2022-23527 - Open Redirect in
oidc_validate_redirect_url() using tab character
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | cjose | 0:0.6.1-4.module+el8.9.0+90009+6a7196cf |
| Oracle Linux · 8 | cjose-devel | 0:0.6.1-4.module+el8.9.0+90009+6a7196cf |
| Oracle Linux · 8 | mod_auth_openidc | 0:2.4.9.4-5.module+el8.9.0+90009+6a7196cf |
Vulnerabilities 2
-
High 7.5
mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied
mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when `OIDCStripCookies` is set and a crafted cookie supplied, a N…
-
Medium 4.7
Open Redirect in oidc_validate_redirect_url()
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_valid…