High ELSA-2025-7419 1 CVE

Important: mod_auth_openidc security update (Oracle Linux 9)

Published May 21, 2025 · Updated May 21, 2025

Ecosystem: Oracle Linux

Summary

[2.4.10-1.el9_6.1]
Resolves: RHEL-86224 - mod_auth_openidc allows OIDCProviderAuthRequestMethod
POSTs to leak protected data (CVE-2025-31492)

Fixed packages 1

Release	Package	Fixed in
Oracle Linux · 9	mod_auth_openidc	0:2.4.10-1.el9_6.1

Vulnerabilities 1

High 8.2

CVE-2025-31492

mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data

mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected c…

OpenIDC mod_auth_openidc libapache2-mod-auth-openidc libapache2-mod-auth-openidc Debian Ubuntu Azure Linux

Apr 6, 2025