The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3499-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 19, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libapache2-mod-auth-openidc     Version        : 2.3.10.2-1+deb10u3     CVE ID         : CVE-2021-39191 CVE-2022-23527     Debian Bug     : 993648 1026444

    Open Redirect vulnerabilities were found in libapache2-mod-auth-openidc,     OpenID Connect Relying Party implementation for Apache, which could lead     to information disclosure via phishing attacks.

    CVE-2021-39191

        The 3rd-party init SSO functionality of mod_auth_openidc was         reported to be vulnerable to an open redirect attack by supplying a         crafted URL in the target_link_uri parameter.

    CVE-2022-23527

        When providing a logout parameter to the redirect URI,         mod_auth_openidc failed to properly check for URLs starting with         /\t, leading to an open redirect.

    For Debian 10 buster, these problems have been fixed in version     2.3.10.2-1+deb10u3.

    We recommend that you upgrade your libapache2-mod-auth-openidc packages.

    For the detailed security status of libapache2-mod-auth-openidc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3499 : libapache2-mod-auth-openidc - security update

medium Nessus Plugin ID 178452

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 8:38 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501222038
Version 1.0 Jul 19, 2023, 8:08 AM New Plugin Feed: 202307190808