Read the docs
Red Hat Security Advisory

RHSA-2022:1823

mod_auth_openidc:2.3 security update

Released 2022-05-10 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Fixes 4 records

TI-2021-12452 CVE-2021-32786

Open Redirect in oidc_validate_redirect_url()

Priority LOW 32

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.02364 Published 2021-07-22 Partial fix · 2.4.9 CWE-601
TI-2021-16576 CVE-2021-39191

URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc

Priority LOW 31

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01735 Published 2021-09-03 Partial fix CWE-601
TI-2021-12458 CVE-2021-32792

XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc

Priority LOW 30

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0151 Published 2021-07-26 Fixed in 2.4.9 CWE-79