Summary
It was discovered that mod_auth_openidc incorrectly handled certain
POST requests. An attacker could possibly use this issue to obtain
sensitive information.
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | libapache2-mod-auth-openidc | 2.4.11-1ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | libapache2-mod-auth-openidc | 2.4.15.1-1ubuntu0.1 |
Vulnerabilities 1
-
High 8.2
mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data
mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.16.11, a bug in a mod_auth_openidc results in disclosure of protected c…
References
-
report
https://ubuntu.com/security/CVE-2025-31492