The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The OpenID Connect Relying Party and OAuth 2.0 Resource Server (aka mod_auth_openidc) module before     2.1.5 for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an     OIDCUnAuthAction pass configuration, which allows remote attackers to bypass authentication via crafted     HTTP traffic. (CVE-2017-6062)

Note that Nessus relies on the presence of the package as reported by the vendor.

Upgrade to latest upstream which fixes some CVEs

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
254692	Linux Distros Unpatched Vulnerability : CVE-2017-6062	Nessus	Misc.	high
130310	Fedora 31 : mod_auth_openidc (2019-a25d5df3b4)	Nessus	Fedora Local Security Checks	high
130306	Fedora 30 : mod_auth_openidc (2019-7b06f18a10)	Nessus	Fedora Local Security Checks	high
130293	Fedora 29 : mod_auth_openidc (2019-23638d42f3)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2017-6062

high

Tenable Plugins

high

high

high

high