OESA-2023-1236

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1236
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1236.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2023-1236
Upstream
Published
2023-04-21T11:05:10Z
Modified
2025-08-12T05:12:37.809812Z
Summary
mod_auth_openidc security update
Details

This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party(RP) to an OpenID Connect Provider(OP).

Security Fix(es):

modauthopenidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidcvalidateredirecturl() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring modauth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.(CVE-2022-23527)

modauthopenidc is an authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using OIDCStripCookies.(CVE-2023-28625)

Database specific 
{
    "severity": "High"
}
References

Affected packages

openEuler:22.03-LTS-SP1 / mod_auth_openidc

Package

Name
mod_auth_openidc
Purl
pkg:rpm/openEuler/mod_auth_openidc&distro=openEuler-22.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.4.13.2-1.oe2203sp1

Ecosystem specific 

{
    "x86_64": [
        "mod_auth_openidc-debugsource-2.4.13.2-1.oe2203sp1.x86_64.rpm",
        "mod_auth_openidc-debuginfo-2.4.13.2-1.oe2203sp1.x86_64.rpm",
        "mod_auth_openidc-2.4.13.2-1.oe2203sp1.x86_64.rpm"
    ],
    "src": [
        "mod_auth_openidc-2.4.13.2-1.oe2203sp1.src.rpm"
    ],
    "aarch64": [
        "mod_auth_openidc-debugsource-2.4.13.2-1.oe2203sp1.aarch64.rpm",
        "mod_auth_openidc-2.4.13.2-1.oe2203sp1.aarch64.rpm",
        "mod_auth_openidc-debuginfo-2.4.13.2-1.oe2203sp1.aarch64.rpm"
    ]
}