CVE-2021-32786
Summary
| CVE | CVE-2021-32786 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2021-07-22 22:15:00 UTC |
|---|
| Updated | 2023-11-07 03:35:00 UTC |
|---|
| Description | mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] [DLA 3409-1] libapache2-mod-auth-openidc security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 33 Update: mod_auth_openidc-2.4.9-1.fc33 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Oracle Critical Patch Update Advisory - April 2022 |
MISC |
www.oracle.com |
|
| Release release 2.4.9 · zmartzone/mod_auth_openidc · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 33 Update: mod_auth_openidc-2.4.9-1.fc33 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| July 2021 Apache HTTP Server Vulnerabilities in NetApp Products | NetApp Product Security |
CONFIRM |
security.netapp.com |
|
| [SECURITY] Fedora 34 Update: mod_auth_openidc-2.4.9-1.fc34 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 34 Update: mod_auth_openidc-2.4.9-1.fc34 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Merge pull request from GHSA-xm4c-5wm5-jqv7 · zmartzone/mod_auth_openidc@3a11548 · GitHub |
MISC |
github.com |
|
| One URL standard please | daniel.haxx.se |
MISC |
daniel.haxx.se |
|
| Open Redirect in oidc_validate_redirect_url() · Advisory · zmartzone/mod_auth_openidc · GitHub |
CONFIRM |
github.com |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 159800 Oracle Enterprise Linux Security Update for mod_auth_openidc:2.3 (ELSA-2022-1823)
- 179805 Debian Security Update for libapache2-mod-auth-openidc (CVE-2021-32786)
- 181758 Debian Security Update for libapache2-mod-auth-openidc (DLA 3409-1)
- 240273 Red Hat Update for mod_auth_openidc:2.3 (RHSA-2022:1823)
- 281777 Fedora Security Update for mod_auth_openidc (FEDORA-2021-17f5cedf66)
- 281778 Fedora Security Update for mod_auth_openidc (FEDORA-2021-e3017c538a)
- 377581 Alibaba Cloud Linux Security Update for mod_auth_openidc:2.3 (ALINUX3-SA-2022:0135)
- 751134 OpenSUSE Security Update for apache2-mod_auth_openidc (openSUSE-SU-2021:3020-1)
- 751149 OpenSUSE Security Update for apache2-mod_auth_openidc (openSUSE-SU-2021:1277-1)
- 751211 SUSE Enterprise Linux Security Update for apache2-mod_auth_openidc (SUSE-SU-2021:3352-1)
- 901439 Common Base Linux Mariner (CBL-Mariner) Security Update for httpd (6480-1)
- 940537 AlmaLinux Security Update for mod_auth_openidc:2.3 (ALSA-2022:1823)
- 960287 Rocky Linux Security Update for mod_auth_openidc:2.3 (RLSA-2022:1823)
