mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.

The remote Fedora 37 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-714b48d4d5 advisory.

    Automatic update for mod_auth_openidc-2.4.9.4-1.fc37.

    ##### **Changelog**

    ```
    * Thu Mar 31 2022 Tomas Halman <thalman@redhat.com> - 2.4.9.4-1
    - Resolves: rhbz#2001647 - CVE-2021-39191 mod_auth_openidc: open redirect                                by supplying a crafted URL in the target_link_uri                                parameter

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the mod_auth_openidc-2.4.9.4-2.el9 build changelog.

  - open redirect by supplying a crafted URL in the target_link_uri parameter (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-02c84fe305 advisory.

    Automatic update for mod_auth_openidc-2.4.12.3-2.fc39.

    ##### **Changelog**

    ```
    * Tue Mar  7 2023 Tomas Halman <thalman@redhat.com> - 2.4.12.3-2     migrated to SPDX license
    * Tue Feb 28 2023 Tomas Halman <thalman@redhat.com> - 2.4.12.3-1     Rebase to 2.4.12.3 version
    - Resolves: rhbz#2164064 - mod_auth_openidc-2.4.12.3 is available
    * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.12.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
    * Fri Dec 16 2022 Tomas Halman <thalman@redhat.com> - 2.4.12.2-1     Rebase to 2.4.12.2 version
    - Resolves: rhbz#2153658 - CVE-2022-23527 mod_auth_openidc: Open Redirect in       oidc_validate_redirect_url() using tab character
    * Thu Sep 22 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.2-3
    - Resolves: rhbz#2128328 - Port pcre dependency to pcre2
    * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.11.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Thu Jun 23 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.2-1
    - Resolves: rhbz#2082376 - New version 2.4.11.2 available
    * Mon Apr 11 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.1-1
    - Resolves: rhbz#1996926 - New version 2.4.11.1 available
    * Thu Mar 31 2022 Tomas Halman <thalman@redhat.com> - 2.4.9.4-1
    - Resolves: rhbz#2001647 - CVE-2021-39191 mod_auth_openidc: open redirect                                by supplying a crafted URL in the target_link_uri                                parameter
    * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.9.1-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
    * Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.4.9.1-2
    - Rebuilt with OpenSSL 3.0.0
    * Wed Aug 18 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.9.1-1
    - New upstream release
    - Resolves: rhbz#1993566 - mod_auth_openidc-2.4.9.1 is available
    * Fri Jul 30 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.9-1
    - Resolves: rhbz#1985153 - mod_auth_openidc-2.4.9 is available
    - Resolves: rhbz#1986103 - CVE-2021-32786 mod_auth_openidc: open redirect                                in oidc_validate_redirect_url()
    - Resolves: rhbz#1986396 - CVE-2021-32791 mod_auth_openidc: hardcoded                                static IV and AAD with a reused key in AES GCM                                encryption
    - Resolves: rhbz#1986398 - CVE-2021-32792 mod_auth_openidc: XSS when using                                OIDCPreservePost On
    * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.8.4-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
    * Wed Jun  2 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.8.3-1
    - New upstream release
    - Resolves: rhbz#1966756 - mod_auth_openidc-2.4.8.3 is available
    * Mon May 10 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.8.2-1
    - New upstream release
    - Resolves: rhbz#1958466 - mod_auth_openidc-2.4.8.2 is available
    * Thu May  6 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.7.2-1
    - New upstream release
    - Resolves: rhbz#1900913 - mod_auth_openidc-2.4.7.2 is available
    * Fri Apr 30 2021 Tomas Halman <thalman@redhat.com> - 2.4.4.1-3
    - Remove unnecessary LTO patch

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2022:1823 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a     result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout     functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect     with slashes to address a particular breaking change between the different specifications (RFC2396 /     RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring     `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
    (CVE-2021-32786)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and     AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this     can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has     been patched to use dynamic values through usage of cjose AES encryption routines. (CVE-2021-32791)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.
    (CVE-2021-32792)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0215-1 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-1823 advisory.

    - Resolves: rhbz#1987222 - CVE-2021-32792 XSS when using OIDCPreservePost On
    - Resolves: rhbz#1987216 - CVE-2021-32791 hardcoded static IV and AAD with a                                reused key in AES GCM encryption [rhel-8] (edit)

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote AlmaLinux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2022:1823 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a     result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout     functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect     with slashes to address a particular breaking change between the different specifications (RFC2396 /     RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring     `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
    (CVE-2021-32786)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and     AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this     can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has     been patched to use dynamic values through usage of cjose AES encryption routines. (CVE-2021-32791)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.
    (CVE-2021-32792)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2022:1823 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)

    * mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)

    * mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)

    * mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the CESA-2022:1823 advisory.

  - mod_auth_openidc: open redirect in oidc_validate_redirect_url() (CVE-2021-32786)

  - mod_auth_openidc: hardcoded static IV and AAD with a reused key in AES GCM encryption (CVE-2021-32791)

  - mod_auth_openidc: XSS when using OIDCPreservePost On (CVE-2021-32792)

  - mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2021:3352-1 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When     mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache     (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc`     wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform     it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not     appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by     repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing     argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be     mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use     when this option is enabled. (CVE-2021-32785)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a     result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout     functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect     with slashes to address a particular breaking change between the different specifications (RFC2396 /     RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring     `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
    (CVE-2021-32786)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and     AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this     can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has     been patched to use dynamic values through usage of cjose AES encryption routines. (CVE-2021-32791)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.
    (CVE-2021-32792)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211145	Fedora 37 : mod_auth_openidc (2022-714b48d4d5)	Nessus	Fedora Local Security Checks	medium
191413	CentOS 9 : mod_auth_openidc-2.4.9.4-2.el9	Nessus	CentOS Local Security Checks	medium
185201	Fedora 39 : mod_auth_openidc (2023-02c84fe305)	Nessus	Fedora Local Security Checks	medium
184483	Rocky Linux 8 : mod_auth_openidc:2.3 (RLSA-2022:1823)	Nessus	Rocky Linux Local Security Checks	medium
178452	Debian DLA-3499-1 : libapache2-mod-auth-openidc - LTS security update	Nessus	Debian Local Security Checks	medium
170904	SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2023:0215-1)	Nessus	SuSE Local Security Checks	medium
161280	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2022-1823)	Nessus	Oracle Linux Local Security Checks	medium
161141	AlmaLinux 8 : mod_auth_openidc:2.3 (ALSA-2022:1823)	Nessus	Alma Linux Local Security Checks	medium
161001	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2022:1823)	Nessus	Red Hat Local Security Checks	medium
160949	CentOS 8 : mod_auth_openidc:2.3 (CESA-2022:1823)	Nessus	CentOS Local Security Checks	medium
154089	SUSE SLES12 Security Update : apache2-mod_auth_openidc (SUSE-SU-2021:3352-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2021-39191

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium