SynopsisThe remote Debian host is missing one or more security-related updates.
DescriptionThe remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory.
- mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 22.214.171.124, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 126.96.36.199 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version.
- mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 188.8.131.52 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 184.108.40.206. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.
SolutionUpgrade the libapache2-mod-auth-openidc packages.
For Debian 10 buster, these problems have been fixed in version 220.127.116.11-1+deb10u3.
File Name: debian_DLA-3499.nasl
Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment
Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C
CPE: p-cpe:/a:debian:debian_linux:libapache2-mod-auth-openidc, cpe:/o:debian:debian_linux:10.0
Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l
Exploit Ease: Exploits are available
Patch Publication Date: 7/19/2023
Vulnerability Publication Date: 9/3/2021