SUSE-SU-2021:3020-1
- Source
- https://www.suse.com/support/update/announcement/2021/suse-su-20213020-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:3020-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2021:3020-1
- Related
- Published
- 2021-09-13T07:17:22Z
- Modified
- 2021-09-13T07:17:22Z
- Summary
- Security update for apache2-mod_auth_openidc
- Details
-
This update for apache2-modauthopenidc fixes the following issues:
- CVE-2021-32785: format string bug via hiredis (bsc#1188638)
- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)
- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)
- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)
- References
-
- https://www.suse.com/support/update/announcement/2021/suse-su-20213020-1/
- https://bugzilla.suse.com/1188638
- https://bugzilla.suse.com/1188639
- https://bugzilla.suse.com/1188848
- https://bugzilla.suse.com/1188849
- https://www.suse.com/security/cve/CVE-2021-32785
- https://www.suse.com/security/cve/CVE-2021-32786
- https://www.suse.com/security/cve/CVE-2021-32791
- https://www.suse.com/security/cve/CVE-2021-32792
Affected packages
SUSE:Linux Enterprise Module for Server Applications 15 SP2 / apache2-mod_auth_openidc
Package
- Name
- apache2-mod_auth_openidc
- Purl
- pkg:rpm/suse/apache2-mod_auth_openidc&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Server%20Applications%2015%20SP2