Description
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| zmartzone | mod_auth_openidc | < 2.4.9 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-auth-openidc | 2.4.9-1 | — |
| Debian 13 | libapache2-mod-auth-openidc | 2.4.9-1 | — |
| Debian 12 | libapache2-mod-auth-openidc | 2.4.9-1 | — |
| Debian 10 | libapache2-mod-auth-openidc | 2.3.10.2-1+deb10u2 | DLA-3409-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
| Ubuntu 18.04 LTS | libapache2-mod-auth-openidc | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | cjose +1 | 0.6.1-2.module+el8+2454+f890a43a | RHSA-2022:1823 |
| RHEL 8 | mod_auth_openidc | 2.3.7-11.module+el8.6.0+14082+b6f23e95 | RHSA-2022:1823 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 8 | cjose +1 | 0.6.1-2.module_el8.6.0+2868+44838709 | ALSA-2022:1823 |
| AlmaLinux 8 | mod_auth_openidc | 2.3.7-11.module_el8.6.0+2868+44838709 | ALSA-2022:1823 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 8 | cjose | 0.6.1-2.module+el8.3.0+129+2feafa46 | RLSA-2022:1823 |
| Rocky Linux 8 | mod_auth_openidc | 2.3.7-11.module+el8.6.0+840+73eca44e | RLSA-2022:1823 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.14.1 | SUSE-SU-2025:4532-1 |
| SLES 15 SP6 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.14.1 | SUSE-SU-2025:4532-1 |
| SLES 15 SP3 | apache2-mod_auth_openidc | 2.3.8-3.15.1 | SUSE-SU-2021:3020-1 |
| SLES 15 SP2 | apache2-mod_auth_openidc | 2.3.8-3.15.1 | SUSE-SU-2021:3020-1 |
| SLES 12 SP5 | apache2-mod_auth_openidc | 2.4.0-3.23.1 | SUSE-SU-2021:3352-1 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP5 | apache2-mod_auth_openidc | 2.4.0-3.23.1 | SUSE-SU-2021:3352-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.6 | apache2-mod_auth_openidc | 2.4.17.1-150600.16.14.1 | SUSE-SU-2025:4532-1 |
| openSUSE Leap 15.3 | apache2-mod_auth_openidc | 2.3.8-3.15.1 | openSUSE-SU-2021:3020-1 |
| openSUSE Leap 15.2 | apache2-mod_auth_openidc | 2.3.8-lp152.5.6.1 | openSUSE-SU-2021:1277-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | httpd | 2.4.52-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | cjose +1 | 0.6.1-2.module+el8+5139+bcb28322 | ELSA-2022-1823 |
| Oracle Linux 8 | mod_auth_openidc | 2.3.7-11.module+el8.6.0+20572+b6f23e95 | ELSA-2022-1823 |
Advisories 11
- ALSA-2022:1823 Moderate: mod_auth_openidc:2.3 security update AlmaLinux Security Advisories · Oct 29, 2026
- DLA-3409-1 libapache2-mod-auth-openidc - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RLSA-2022:1823 Moderate: mod_auth_openidc:2.3 security update Rocky Linux Security Advisories · Feb 4, 2026
- openSUSE-SU-2021:1277-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:3020-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2025:4532-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-0580 Red Hat Enterprise Linux (mod_auth_openidc): Mehrere Schwachstellen BSI CERT-Bund (WID) · Dec 29, 2025
- RHSA-2022:1823 Red Hat Security Advisory: mod_auth_openidc:2.3 security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- openSUSE-SU-2021:3020-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · May 7, 2025
- SUSE-SU-2021:3352-1 Security update for apache2-mod_auth_openidc SUSE / openSUSE Security Updates · May 2, 2025
- ELSA-2022-1823 Moderate: mod_auth_openidc:2.3 security update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · May 17, 2022
References
- https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9
- https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7j-3r9r
- https://github.com/zmartzone/mod_auth_openidc/commit/375407c16c61a70b56fdbe13b0d2c8f11398e92c
- FEDORA-2021-e3017c538a vendor-advisory
- FEDORA-2021-17f5cedf66 vendor-advisory
- https://www.oracle.com/security-alerts/cpuapr2022.html
- [debian-lts-announce] 20230430 [SECURITY] [DLA 3409-1] libapache2-mod-auth-openidc security update mailing-list