Red Hat Security Advisory

RHSA-2023:6940

mod_auth_openidc:2.3 security and bug fix update

Released 2023-11-14 · Red Hat rating Moderate · View on Red Hat →

Fixed in

Red Hat Enterprise Linux AppStream (v. 8) cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.aarch64::mod_auth_openidc:2.3, cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.ppc64le::mod_auth_openidc:2.3, cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.s390x::mod_auth_openidc:2.3 +11

Fixes 2 records

TI-2023-13144 CVE-2023-28625

mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied

MEDIUM 42

mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01316 Published 2023-04-03 Fixed in 2.4.13.2 CWE-476

TI-2022-07586 CVE-2022-23527

Open Redirect in oidc_validate_redirect_url()

LOW 29

mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00941 Published 2022-12-14 Partial fix · 2.4.12.2 CWE-601