Detections
Analytics
Debian DLA-2298-1 : libapache2-mod-auth-openidc security update
medium Nessus Plugin ID 139098
Language:
Synopsis
The remote Debian host is missing a security update.Description
Several issues have been found in libapache2-mod-auth-openidc, the OpenID Connect authentication module for the Apache HTTP server.CVE-2019-14857
Insufficient validation of URLs leads to an Open Redirect vulnerability. An attacker may trick a victim into providing credentials for an OpenID provider by forwarding the request to an illegitimate website.
CVE-2019-20479
Due to insufficient validatation of URLs an Open Redirect vulnerability for URLs beginning with a slash and backslash could be abused.
CVE-2019-1010247
The OIDCRedirectURI page contains generated JavaScript code that uses a poll parameter as a string variable, thus might contain additional JavaScript code. This might result in Criss-Site Scripting (XSS).
For Debian 9 stretch, these problems have been fixed in version 2.1.6-1+deb9u1.
We recommend that you upgrade your libapache2-mod-auth-openidc packages.
For the detailed security status of libapache2-mod-auth-openidc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libapache2-mod-auth-openid c
NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.
Solution
Upgrade the affected libapache2-mod-auth-openidc package.See Also
https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html
https://packages.debian.org/source/stretch/libapache2-mod-auth-openidc
Plugin Details
Severity: Medium
ID: 139098
File Name: debian_DLA-2298.nasl
Version: 1.3
Type: local
Agent: unix
Family: Debian Local Security Checks
Published: 7/30/2020
Updated: 2/27/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.0
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2019-20479
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.3
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: p-cpe:/a:debian:debian_linux:libapache2-mod-auth-openidc, cpe:/o:debian:debian_linux:9.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: No known exploits are available
Patch Publication Date: 7/29/2020
Vulnerability Publication Date: 7/19/2019