CVE-2017-6413
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2017-6413
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2017-6413.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2017-6413
- Related
- Published
- 2017-03-02T06:59:01Z
- Modified
- 2025-01-08T10:13:06.825053Z
- Severity
-
- 8.6 (High) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N CVSS Calculator
- Summary
- [none]
- Details
-
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka modauthopenidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
- References
-
- https://access.redhat.com/errata/RHSA-2019:2112
- https://github.com/pingidentity/mod_auth_openidc/blob/master/ChangeLog
- https://github.com/pingidentity/mod_auth_openidc/commit/21e3728a825c41ab41efa75e664108051bb9665e
- https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.6
- http://www.securityfocus.com/bid/96549
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2V3HIGXMUKJGOBMAQAQPGC7G5YYWSUVA/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EJXBG3DG2FUYFGTUTSJFMPIINVFKKB4Z/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTWUMQ46GZY3O4WU4JCF333LN53R2XQH/
- https://security-tracker.debian.org/tracker/CVE-2017-6413
Affected packages
Debian:11 / libapache2-mod-auth-openidc
Package
- Name
- libapache2-mod-auth-openidc
- Purl
- pkg:deb/debian/libapache2-mod-auth-openidc?arch=source
Debian:12 / libapache2-mod-auth-openidc
Package
- Name
- libapache2-mod-auth-openidc
- Purl
- pkg:deb/debian/libapache2-mod-auth-openidc?arch=source
Debian:13 / libapache2-mod-auth-openidc
Package
- Name
- libapache2-mod-auth-openidc
- Purl
- pkg:deb/debian/libapache2-mod-auth-openidc?arch=source