The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian DLA-3499-1 : libapache2-mod-auth-openidc - LTS security update

medium Nessus Plugin ID 178452

Version 1.0