mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.

The remote Redhat Enterprise Linux 7 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - mod_auth_openidc: open redirect due to target_link_uri parameter not validated (CVE-2021-39191)

  - mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a     result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout     functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect     with slashes to address a particular breaking change between the different specifications (RFC2396 /     RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring     `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
    (CVE-2021-32786)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and     AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this     can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has     been patched to use dynamic values through usage of cjose AES encryption routines. (CVE-2021-32791)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server that implements the OpenID Connect Relying Party functionality. In affected versions missing input     validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of     service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they     manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like     99999999, the server struggles with the request for a long time and finally gets back with a 500 error.
    Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests     that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal     effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no     known workarounds for this vulnerability. (CVE-2024-24814)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the mod_auth_openidc-2.4.9.4-2.el9 build changelog.

  - open redirect by supplying a crafted URL in the target_link_uri parameter (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6940 advisory.

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

  - mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that     implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when     `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting     in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an     availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using     `OIDCStripCookies`. (CVE-2023-28625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2023-6365 advisory.

  - mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that     implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when     `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting     in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an     availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using     `OIDCStripCookies`. (CVE-2023-28625)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2023:6940 advisory.

  - mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

  - mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is     supplied (CVE-2023-28625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-02c84fe305 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a     result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout     functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect     with slashes to address a particular breaking change between the different specifications (RFC2396 /     RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring     `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
    (CVE-2021-32786)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and     AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this     can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has     been patched to use dynamic values through usage of cjose AES encryption routines. (CVE-2021-32791)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In     mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`.
    (CVE-2021-32792)

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6365 advisory.

  - mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

  - mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is     supplied (CVE-2023-28625)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2023:0215-1 advisory.

  - mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions     as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions     prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable     to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in     version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the     `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
    (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 36 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-6beaa3bd0c advisory.

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
195625	RHEL 7 : mod_auth_openidc (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
191413	CentOS 9 : mod_auth_openidc-2.4.9.4-2.el9	Nessus	CentOS Local Security Checks	medium
186092	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2023-6940)	Nessus	Oracle Linux Local Security Checks	medium
185822	Oracle Linux 9 : mod_auth_openidc (ELSA-2023-6365)	Nessus	Oracle Linux Local Security Checks	medium
185656	RHEL 8 : mod_auth_openidc:2.3 (RHSA-2023:6940)	Nessus	Red Hat Local Security Checks	medium
185201	Fedora 39 : mod_auth_openidc (2023-02c84fe305)	Nessus	Fedora Local Security Checks	medium
185112	RHEL 9 : mod_auth_openidc (RHSA-2023:6365)	Nessus	Red Hat Local Security Checks	medium
178452	Debian DLA-3499-1 : libapache2-mod-auth-openidc - LTS security update	Nessus	Debian Local Security Checks	medium
170904	SUSE SLES15 / openSUSE 15 Security Update : apache2-mod_auth_openidc (SUSE-SU-2023:0215-1)	Nessus	SuSE Local Security Checks	medium
169297	Fedora 36 : mod_auth_openidc (2022-6beaa3bd0c)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2022-23527

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium