Open Redirect and NULL Pointer Dereference in mod_auth_openidc:2.3
Summary
ALSA-2023:6940: Moderate: mod_auth_openidc:2.3 security and bug fix update. Affects cjose versions < 0.6.1-4.module_el8.9.0+3631+0ced13d7. Fixed in 0.6.1-4.module_el8.9.0+3631+0ced13d7. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It allows Apache HTTP Server to function as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. This module provides secure authentication and authorization capabilities for web applications. It has been identified that mod_auth_openidc versions prior to 2.4.9.4 are vulnerable to two security issues.
Vulnerability Detail
The first vulnerability, identified as CVE-2022-23527, is an Open Redirect vulnerability in the oidc_validate_redirect_url() function. An attacker can exploit this vulnerability by using a tab character in the redirect URL, leading to a redirect to an arbitrary URL. The impact of this vulnerability can range from phishing attacks to unauthorized access to sensitive information.
The second vulnerability, identified as CVE-2023-28625, is a NULL pointer dereference issue. It occurs when the OIDCStripCookies configuration option is enabled, and a crafted Cookie header is supplied. This can result in a crash of the Apache HTTP Server process, leading to a denial of service condition.
How To Fix
Minimum fixed version
0.6.1-4.module_el8.9.0+3631+0ced13d7
This is the first release that contains the fix.
sudo dnf update cjoseTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no specific workarounds mentioned for these vulnerabilities. It is advised to apply the recommended fix by updating mod_auth_openidc to the latest version.
Conclusion
mod_auth_openidc versions prior to 2.4.9.4 are vulnerable to an Open Redirect vulnerability (CVE-2022-23527) and a NULL pointer dereference vulnerability (CVE-2023-28625). It is crucial to update to the latest version of mod_auth_openidc to mitigate these vulnerabilities. For further support on vulnerability remediation, you can reach out to DevNack.com.
See every vulnerability recorded for cjose →
FAQ
mod_auth_openidc is an Apache HTTP Server module that enables it to function as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. It provides secure authentication and authorization capabilities for web applications.
The Open Redirect vulnerability in mod_auth_openidc can be exploited by an attacker to redirect users to malicious websites, potentially leading to phishing attacks or unauthorized access to sensitive information.
The NULL pointer dereference vulnerability in mod_auth_openidc can result in a crash of the Apache HTTP Server process when a crafted Cookie header is supplied. This can lead to a denial of service condition.
To fix these vulnerabilities, update mod_auth_openidc to version 2.4.9.4 or later. This version includes the necessary patches to address the identified security issues.
The update for mod_auth_openidc can be obtained from the official AlmaLinux repositories or the mod_auth_openidc project's official website.
Related vulnerabilities
Recent vulnerabilities recorded for cjose.
