| Description: | Summary:
The remote host is missing an update for the Debian 'libapache2-mod-auth-openidc' package(s) announced via the DLA-3409-1 advisory.
Vulnerability Insight:
Several vulnerabilities were fixed in libapache2-mod-auth-openidc, an OpenID Connect Relying Party implementation for Apache.
CVE-2019-20479
Insufficient validatation of URLs beginning with a slash and backslash.
CVE-2021-32785
Crash when using an unencrypted Redis cache.
CVE-2021-32786
Open Redirect vulnerability in the logout functionality.
CVE-2021-32791
AES GCM encryption in used static IV and AAD.
CVE-2021-32792
XSS vulnerability when using OIDCPreservePost.
CVE-2023-28625
NULL pointer dereference with OIDCStripCookies.
For Debian 10 buster, these problems have been fixed in version 2.3.10.2-1+deb10u2.
We recommend that you upgrade your libapache2-mod-auth-openidc packages.
For the detailed security status of libapache2-mod-auth-openidc please refer to its security tracker page at: [link moved to references]
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: [link moved to references]
Affected Software/OS:
'libapache2-mod-auth-openidc' package(s) on Debian 10.
Solution:
Please install the updated package(s).
CVSS Score:
5.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:N
|
