mod_auth_openidc Security and Bug Fix Update
Summary
ALSA-2023:6365: Moderate: mod_auth_openidc security and bug fix update. Affects mod_auth_openidc versions < 2.4.9.4-4.el9. Fixed in 2.4.9.4-4.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It allows Apache HTTP Server to function as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. This module enables secure authentication and authorization using OpenID Connect and OAuth 2.0 protocols.
Vulnerability Detail
The mod_auth_openidc module has two security vulnerabilities:
-
Open Redirect in oidc_validate_redirect_url(): This vulnerability, identified as CVE-2022-23527, allows an attacker to perform an open redirect attack by using a tab character in the redirect URL. This can lead to phishing attacks and unauthorized access.
-
NULL Pointer Dereference in OIDCStripCookies: This vulnerability, known as CVE-2023-28625, occurs when the OIDCStripCookies configuration is set and a maliciously crafted Cookie header is provided. It can result in a NULL pointer dereference, leading to a denial of service (DoS) condition.
Both vulnerabilities have moderate severity and can be exploited by remote attackers.
How To Fix
Minimum fixed version
2.4.9.4-4.el9
This is the first release that contains the fix.
sudo dnf update mod_auth_openidcTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities. It is essential to apply the recommended package update to ensure the security of the system.
Conclusion
To ensure the security of your system, it is crucial to update the mod_auth_openidc package to version 2.4.9.4-4.el9 or later. This update addresses two moderate-severity vulnerabilities that can be exploited by remote attackers. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for mod_auth_openidc →
FAQ
mod_auth_openidc is an Apache HTTP Server module that enables OpenID Connect authentication and OAuth 2.0 authorization. It allows the server to act as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.
An open redirect attack is a type of security vulnerability that allows an attacker to redirect users to malicious websites. In the case of mod_auth_openidc, the CVE-2022-23527 vulnerability enables an attacker to perform such attacks by manipulating the redirect URL.
A NULL pointer dereference occurs when a program attempts to access or manipulate memory using a NULL pointer. In the case of mod_auth_openidc and the CVE-2023-28625 vulnerability, a crafted Cookie header can trigger a NULL pointer dereference, leading to a denial of service.
The impact of these vulnerabilities can vary. The open redirect vulnerability (CVE-2022-23527) can be exploited for phishing attacks and unauthorized access. The NULL pointer dereference vulnerability (CVE-2023-28625) can result in a denial of service condition, causing the affected server to become unresponsive.
You can use Vulert's playground at Vulert Scanner to check if your system is affected by these vulnerabilities. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for mod_auth_openidc.
