The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.

Upgrade to latest upstream which fixes some CVEs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
130310	Fedora 31 : mod_auth_openidc (2019-a25d5df3b4)	Nessus	Fedora Local Security Checks	high
130306	Fedora 30 : mod_auth_openidc (2019-7b06f18a10)	Nessus	Fedora Local Security Checks	high
130293	Fedora 29 : mod_auth_openidc (2019-23638d42f3)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-6062

high

Tenable Plugins

high

high

high