MGASA-2021-0452

Dashboard / Vulnerabilities / MGASA-2021-0452

MGASA-2021-0452

Summary: Updated apache-mod_auth_openidc packages fix security vulnerability

Details: In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. (CVE-2021-32786) In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. (CVE-2021-32791) In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`. (CVE-2021-32792)

References: https://advisories.mageia.org/MGASA-2021-0452.html, https://bugs.mageia.org/show_bug.cgi?id=29344, https://lists.fedoraproject.org/archives/list/[email protected]/thread/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU/, https://lists.suse.com/pipermail/sle-security-updates/2021-September/009431.html, https://lists.opensuse.org/archives/list/[email protected]/thread/54B4RYNP5L63X2FMX2QCVYB2LGLL42IY/