mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e139408490 advisory.

    CVE-2022-23527 mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-105be2997e advisory.

    Automatic update for mod_auth_openidc-2.4.12.2-1.fc38.

    ##### **Changelog**

    ```
    * Fri Dec 16 2022 Tomas Halman <thalman@redhat.com> - 2.4.12.2-1     Rebase to 2.4.12.2 version
    - Resolves: rhbz#2153658 - CVE-2022-23527 mod_auth_openidc: Open Redirect in       oidc_validate_redirect_url() using tab character

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the mod_auth_openidc-2.4.9.4-2.el9 build changelog.

  - open redirect by supplying a crafted URL in the target_link_uri parameter (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6940 advisory.

    - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual       Authentication Tag provided in the JWE       Resolves: rhbz#2223308

    mod_auth_openidc     Related: rhbz#2141850 - fix cjose version dependency

    Resolves: rhbz#2141850 - auth_openidc.conf mode 0640 by default
    - Resolves: rhbz#2184144 - CVE-2023-28625 NULL pointer dereference           when OIDCStripCookies is set and a crafted Cookie header is supplied

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6365 advisory.

    - Resolves: rhbz#2184145 - CVE-2023-28625 NULL pointer dereference       when OIDCStripCookies is set and a crafted Cookie header is supplied

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6940 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

    * mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is     supplied (CVE-2023-28625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-02c84fe305 advisory.

    Automatic update for mod_auth_openidc-2.4.12.3-2.fc39.

    ##### **Changelog**

    ```
    * Tue Mar  7 2023 Tomas Halman <thalman@redhat.com> - 2.4.12.3-2     migrated to SPDX license
    * Tue Feb 28 2023 Tomas Halman <thalman@redhat.com> - 2.4.12.3-1     Rebase to 2.4.12.3 version
    - Resolves: rhbz#2164064 - mod_auth_openidc-2.4.12.3 is available
    * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.12.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
    * Fri Dec 16 2022 Tomas Halman <thalman@redhat.com> - 2.4.12.2-1     Rebase to 2.4.12.2 version
    - Resolves: rhbz#2153658 - CVE-2022-23527 mod_auth_openidc: Open Redirect in       oidc_validate_redirect_url() using tab character
    * Thu Sep 22 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.2-3
    - Resolves: rhbz#2128328 - Port pcre dependency to pcre2
    * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.11.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Thu Jun 23 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.2-1
    - Resolves: rhbz#2082376 - New version 2.4.11.2 available
    * Mon Apr 11 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.1-1
    - Resolves: rhbz#1996926 - New version 2.4.11.1 available
    * Thu Mar 31 2022 Tomas Halman <thalman@redhat.com> - 2.4.9.4-1
    - Resolves: rhbz#2001647 - CVE-2021-39191 mod_auth_openidc: open redirect                                by supplying a crafted URL in the target_link_uri                                parameter
    * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.9.1-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
    * Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.4.9.1-2
    - Rebuilt with OpenSSL 3.0.0
    * Wed Aug 18 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.9.1-1
    - New upstream release
    - Resolves: rhbz#1993566 - mod_auth_openidc-2.4.9.1 is available
    * Fri Jul 30 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.9-1
    - Resolves: rhbz#1985153 - mod_auth_openidc-2.4.9 is available
    - Resolves: rhbz#1986103 - CVE-2021-32786 mod_auth_openidc: open redirect                                in oidc_validate_redirect_url()
    - Resolves: rhbz#1986396 - CVE-2021-32791 mod_auth_openidc: hardcoded                                static IV and AAD with a reused key in AES GCM                                encryption
    - Resolves: rhbz#1986398 - CVE-2021-32792 mod_auth_openidc: XSS when using                                OIDCPreservePost On
    * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.8.4-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
    * Wed Jun  2 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.8.3-1
    - New upstream release
    - Resolves: rhbz#1966756 - mod_auth_openidc-2.4.8.3 is available
    * Mon May 10 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.8.2-1
    - New upstream release
    - Resolves: rhbz#1958466 - mod_auth_openidc-2.4.8.2 is available
    * Thu May  6 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.7.2-1
    - New upstream release
    - Resolves: rhbz#1900913 - mod_auth_openidc-2.4.7.2 is available
    * Fri Apr 30 2021 Tomas Halman <thalman@redhat.com> - 2.4.4.1-3
    - Remove unnecessary LTO patch

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6365 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

    * mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is     supplied (CVE-2023-28625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0215-1 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6beaa3bd0c advisory.

    CVE-2022-23527 mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
211299	Fedora 37 : mod_auth_openidc (2022-e139408490)	Nessus	Fedora Local Security Checks	medium
211252	Fedora 38 : mod_auth_openidc (2022-105be2997e)	Nessus	Fedora Local Security Checks	medium
191413	CentOS 9 : mod_auth_openidc-2.4.9.4-2.el9	Nessus	CentOS Local Security Checks	medium
186092	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2023-6940)	Nessus	Oracle Linux Local Security Checks	medium
185822	Oracle Linux 9 : mod_auth_openidc (ELSA-2023-6365)	Nessus	Oracle Linux Local Security Checks	medium
185656	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2023:6940)	Nessus	Red Hat Local Security Checks	medium
185201	Fedora 39 : mod_auth_openidc (2023-02c84fe305)	Nessus	Fedora Local Security Checks	medium
185112	RHEL 9 : mod_auth_openidc (RHSA-2023:6365)	Nessus	Red Hat Local Security Checks	medium
178452	Debian DLA-3499-1 : libapache2-mod-auth-openidc - LTS security update	Nessus	Debian Local Security Checks	medium
170904	SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2023:0215-1)	Nessus	SuSE Local Security Checks	medium
169297	Fedora 36 : mod_auth_openidc (2022-6beaa3bd0c)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2022-23527

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium