Detections
Analytics
CentOS 9 : mod_auth_openidc-2.4.9.1-1.el9
medium Nessus Plugin ID 191294
Language:
Synopsis
The remote CentOS host is missing one or more security updates for mod_auth_openidc.Description
The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the mod_auth_openidc-2.4.9.1-1.el9 build changelog.- open redirect in oidc_validate_redirect_url() [rhel-9.0] (CVE-2021-32786)
- hardcoded static IV and AAD with a reused key in AES GCM encryption [rhel-9.0] (CVE-2021-32791)
- XSS when using OIDCPreservePost On [rhel-9.0] (CVE-2021-32792)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Update the CentOS 9 Stream mod_auth_openidc package.See Also
https://kojihub.stream.centos.org/koji/buildinfo?buildID=13607
Plugin Details
Severity: Medium
ID: 191294
File Name: centos9_mod_auth_openidc-2_4_9_1-1.nasl
Version: 1.1
Type: local
Agent: unix
Family: CentOS Local Security Checks
Published: 2/29/2024
Updated: 4/26/2024
Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus
Risk Information
VPR
Risk Factor: Low
Score: 3.8
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.5
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2021-32786
CVSS v3
Risk Factor: Medium
Base Score: 6.1
Temporal Score: 5.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CVSS Score Source: CVE-2021-32792
Vulnerability Information
CPE: p-cpe:/a:centos:centos:mod_auth_openidc, cpe:/a:centos:centos:9
Required KB Items: Host/local_checks_enabled, Host/CentOS/release, Host/CentOS/rpm-list, Host/cpu
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 8/18/2021
Vulnerability Publication Date: 7/22/2021