The remote Debian 10 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-3499 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3499-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                       Guilhem Moulin     July 19, 2023                                 https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : libapache2-mod-auth-openidc     Version        : 2.3.10.2-1+deb10u3     CVE ID         : CVE-2021-39191 CVE-2022-23527     Debian Bug     : 993648 1026444

    Open Redirect vulnerabilities were found in libapache2-mod-auth-openidc,     OpenID Connect Relying Party implementation for Apache, which could lead     to information disclosure via phishing attacks.

    CVE-2021-39191

        The 3rd-party init SSO functionality of mod_auth_openidc was         reported to be vulnerable to an open redirect attack by supplying a         crafted URL in the target_link_uri parameter.

    CVE-2022-23527

        When providing a logout parameter to the redirect URI,         mod_auth_openidc failed to properly check for URLs starting with         /\t, leading to an open redirect.

    For Debian 10 buster, these problems have been fixed in version     2.3.10.2-1+deb10u3.

    We recommend that you upgrade your libapache2-mod-auth-openidc packages.

    For the detailed security status of libapache2-mod-auth-openidc please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2023:6365 advisory.

    The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an     Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

    Security Fix(es):

    * mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)

    * mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is     supplied (CVE-2023-28625)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 9.3 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 39 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2023-02c84fe305 advisory.

    Automatic update for mod_auth_openidc-2.4.12.3-2.fc39.

    ##### **Changelog**

    ```
    * Tue Mar  7 2023 Tomas Halman <thalman@redhat.com> - 2.4.12.3-2     migrated to SPDX license
    * Tue Feb 28 2023 Tomas Halman <thalman@redhat.com> - 2.4.12.3-1     Rebase to 2.4.12.3 version
    - Resolves: rhbz#2164064 - mod_auth_openidc-2.4.12.3 is available
    * Thu Jan 19 2023 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.12.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_38_Mass_Rebuild
    * Fri Dec 16 2022 Tomas Halman <thalman@redhat.com> - 2.4.12.2-1     Rebase to 2.4.12.2 version
    - Resolves: rhbz#2153658 - CVE-2022-23527 mod_auth_openidc: Open Redirect in       oidc_validate_redirect_url() using tab character
    * Thu Sep 22 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.2-3
    - Resolves: rhbz#2128328 - Port pcre dependency to pcre2
    * Thu Jul 21 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.11.2-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_37_Mass_Rebuild
    * Thu Jun 23 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.2-1
    - Resolves: rhbz#2082376 - New version 2.4.11.2 available
    * Mon Apr 11 2022 Tomas Halman <thalman@redhat.com> - 2.4.11.1-1
    - Resolves: rhbz#1996926 - New version 2.4.11.1 available
    * Thu Mar 31 2022 Tomas Halman <thalman@redhat.com> - 2.4.9.4-1
    - Resolves: rhbz#2001647 - CVE-2021-39191 mod_auth_openidc: open redirect                                by supplying a crafted URL in the target_link_uri                                parameter
    * Thu Jan 20 2022 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.9.1-3
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_36_Mass_Rebuild
    * Tue Sep 14 2021 Sahana Prasad <sahana@redhat.com> - 2.4.9.1-2
    - Rebuilt with OpenSSL 3.0.0
    * Wed Aug 18 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.9.1-1
    - New upstream release
    - Resolves: rhbz#1993566 - mod_auth_openidc-2.4.9.1 is available
    * Fri Jul 30 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.9-1
    - Resolves: rhbz#1985153 - mod_auth_openidc-2.4.9 is available
    - Resolves: rhbz#1986103 - CVE-2021-32786 mod_auth_openidc: open redirect                                in oidc_validate_redirect_url()
    - Resolves: rhbz#1986396 - CVE-2021-32791 mod_auth_openidc: hardcoded                                static IV and AAD with a reused key in AES GCM                                encryption
    - Resolves: rhbz#1986398 - CVE-2021-32792 mod_auth_openidc: XSS when using                                OIDCPreservePost On
    * Thu Jul 22 2021 Fedora Release Engineering <releng@fedoraproject.org> - 2.4.8.4-2
    - Rebuilt for https://fedoraproject.org/wiki/Fedora_35_Mass_Rebuild
    * Wed Jun  2 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.8.3-1
    - New upstream release
    - Resolves: rhbz#1966756 - mod_auth_openidc-2.4.8.3 is available
    * Mon May 10 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.8.2-1
    - New upstream release
    - Resolves: rhbz#1958466 - mod_auth_openidc-2.4.8.2 is available
    * Thu May  6 2021 Jakub Hrozek <jhrozek@redhat.com> - 2.4.7.2-1
    - New upstream release
    - Resolves: rhbz#1900913 - mod_auth_openidc-2.4.7.2 is available
    * Fri Apr 30 2021 Tomas Halman <thalman@redhat.com> - 2.4.4.1-3
    - Remove unnecessary LTO patch

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote CentOS Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the mod_auth_openidc-2.4.9.4-2.el9 build changelog.

  - open redirect by supplying a crafted URL in the target_link_uri parameter (CVE-2021-39191)

  - mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed. (CVE-2022-23527)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2022-105be2997e advisory.

    Automatic update for mod_auth_openidc-2.4.12.2-1.fc38.

    ##### **Changelog**

    ```
    * Fri Dec 16 2022 Tomas Halman <thalman@redhat.com> - 2.4.12.2-1     Rebase to 2.4.12.2 version
    - Resolves: rhbz#2153658 - CVE-2022-23527 mod_auth_openidc: Open Redirect in       oidc_validate_redirect_url() using tab character

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 37 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2022-e139408490 advisory.

    CVE-2022-23527 mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 3 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2023:0283 advisory.

    Package updates are available for TencentOS Server 3 that fix the following vulnerabilities:

      CVE-2022-23527:
      mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x     HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter     to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs     that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users     unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when     the destination matches a given regular expression with OIDCRedirectURLsAllowed.

      CVE-2023-28625:
      mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that     implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when     OIDCStripCookies is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting     in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an     availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using     OIDCStripCookies.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2023-6940 advisory.

    - CVE-2023-37464 cjose: AES GCM decryption uses the Tag length from the actual       Authentication Tag provided in the JWE       Resolves: rhbz#2223308

    mod_auth_openidc     Related: rhbz#2141850 - fix cjose version dependency

    Resolves: rhbz#2141850 - auth_openidc.conf mode 0640 by default
    - Resolves: rhbz#2184144 - CVE-2023-28625 NULL pointer dereference           when OIDCStripCookies is set and a crafted Cookie header is supplied

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the TSSA-2024:0264 advisory.

    Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:

    CVE-2022-23527:
    mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to     the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that     start with //t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable     to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the     destination matches a given regular expression with OIDCRedirectURLsAllowed.

    CVE-2023-28625:
    mod_auth_openidc is an authentication and authorization module for the Apache 2.x HTTP server that     implements the OpenID Connect Relying Party functionality. In versions 2.0.0 through 2.4.13.1, when     `OIDCStripCookies` is set and a crafted cookie supplied, a NULL pointer dereference would occur, resulting     in a segmentation fault. This could be used in a Denial-of-Service attack and thus presents an     availability risk. Version 2.4.13.2 contains a patch for this issue. As a workaround, avoid using     `OIDCStripCookies`.

    CVE-2024-24814:
    mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP     server that implements the OpenID Connect Relying Party functionality. In affected versions missing input     validation on mod_auth_openidc_session_chunks cookie value makes the server vulnerable to a denial of     service (DoS) attack. An internal security audit has been conducted and the reviewers found that if they     manipulated the value of the mod_auth_openidc_session_chunks cookie to a very large integer, like     99999999, the server struggles with the request for a long time and finally gets back with a 500 error.
    Making a few requests of this kind caused our server to become unresponsive. Attackers can craft requests     that would make the server work very hard (and possibly become unresponsive) and/or crash with minimal     effort. This issue has been addressed in version 2.4.15.2. Users are advised to upgrade. There are no     known workarounds for this vulnerability.

Tenable has extracted the preceding description block directly from the Tencent Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
178452	Debian dla-3499 : libapache2-mod-auth-openidc - security update	Nessus	Debian Local Security Checks	2023/7/19	2025/1/22	medium
185112	RHEL 9 : mod_auth_openidc (RHSA-2023:6365)	Nessus	Red Hat Local Security Checks	2023/11/7	2024/11/7	medium
185201	Fedora 39 : mod_auth_openidc (2023-02c84fe305)	Nessus	Fedora Local Security Checks	2023/11/7	2024/11/14	medium
191413	CentOS 9 : mod_auth_openidc-2.4.9.4-2.el9	Nessus	CentOS Local Security Checks	2024/2/29	2024/4/26	medium
211252	Fedora 38 : mod_auth_openidc (2022-105be2997e)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	medium
211299	Fedora 37 : mod_auth_openidc (2022-e139408490)	Nessus	Fedora Local Security Checks	2024/11/14	2024/11/14	medium
238506	TencentOS Server 3: mod_auth_openidc:2.3 (TSSA-2023:0283)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/5	medium
186092	Oracle Linux 8 : mod_auth_openidc:2.3 (ELSA-2023-6940)	Nessus	Oracle Linux Local Security Checks	2023/11/21	2025/9/9	medium
238625	TencentOS Server 4: mod_auth_openidc (TSSA-2024:0264)	Nessus	Tencent Local Security Checks	2025/6/16	2025/12/4	medium

检测

插件搜索

medium

medium

medium

medium

medium

medium

medium

medium

medium