CVE-2021-32792

Source

https://nvd.nist.gov/vuln/detail/CVE-2021-32792

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-32792.json

Aliases

• GHSA-458c-7pwg-3j7j

Related

• ALSA-2022:1823
• DLA-3409-1
• RLSA-2022:1823

Published

2021-07-26T17:15:08Z

Modified

2023-11-29T08:55:20.017393Z

Details

modauthopenidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In modauthopenidc before version 2.4.9, there is an XSS vulnerability in when using OIDCPreservePost On.

References

• https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-458c-7pwg-3j7j
• https://github.com/zmartzone/mod_auth_openidc/commit/00c315cb0c8ab77c67be4a2ac08a71a83ac58751
• https://github.com/zmartzone/mod_auth_openidc/commit/55ea0a085290cd2c8cdfdd960a230cbc38ba8b56
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9
• https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXAWKPT5LXZSUTFSJ6IWSZC7RMYYQXQD/