Medium WID-SEC-2023-0580 4 CVEs

Red Hat Enterprise Linux (mod_auth_openidc): Mehrere Schwachstellen

Published May 10, 2022 · Updated Dec 29, 2025 · Revision 5 · de-DE

Vendor: Debian Vendor: Fedora Vendor: Oracle Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux Product: Linux Product: Linux Platform: Linux

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um falsche Informationen darzustellen, vertrauliche Informationen offenzulegen und einen Cross-Site-Scripting Angriff durchzuführen.

Product

Red Hat Enterprise Linux (RHEL) ist eine populäre Linux-Distribution.

Vulnerabilities 4

Medium 5.9

CVE-2021-32791

Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encrypt…

ZmartZone mod_auth_openidc httpd libapache2-mod-auth-openidc Debian Ubuntu Azure Linux

Jul 26, 2021
Medium 4.7

CVE-2021-32786

Open Redirect in oidc_validate_redirect_url()

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` do…

ZmartZone mod_auth_openidc httpd libapache2-mod-auth-openidc Debian Ubuntu Azure Linux

Jul 22, 2021
Medium 4.7

CVE-2021-39191

URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO function…

ZmartZone mod_auth_openidc libapache2-mod-auth-openidc libapache2-mod-auth-openidc Debian Ubuntu Azure Linux

Sep 3, 2021
Low 3.1

CVE-2021-32792

XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vul…

ZmartZone mod_auth_openidc httpd libapache2-mod-auth-openidc Debian Ubuntu Azure Linux

Jul 26, 2021

Revision history

2025-12-29 #5
Neue Updates von SUSE aufgenommen
2023-07-18 #4
Neue Updates von Debian aufgenommen
2023-03-06 #3
Neue Updates von Fedora aufgenommen
2022-05-17 #2
Neue Updates von Oracle Linux aufgenommen
2022-05-10 #1
Initiale Fassung

References

Red Hat Security Advisory vom 2022-05-10
https://access.redhat.com/errata/RHSA-2022:1823
Oracle Linux Security Advisory ELSA-2022-1823 vom 2022-05-17
https://linux.oracle.com/errata/ELSA-2022-1823.html
Fedora Security Advisory FEDORA-2023-02C84FE305 vom 2023-03-07
https://bodhi.fedoraproject.org/updates/FEDORA-2023-02c84fe305
Debian Security Advisory DLA-3499 vom 2023-07-19
https://lists.debian.org/debian-lts-announce/2023/07/msg00020.html
SUSE Security Update SUSE-SU-2025:4532-1 vom 2025-12-29
https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/BBKJJQYVUC6MKZNDXGZERGROZTUYLEKW/
SUSE Security Update SUSE-SU-2025:4532-1 vom 2025-12-29
https://lists.suse.com/pipermail/sle-security-updates/2025-December/023659.html