SUSE-SU-2021:3352-1
- Source
- https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/
- Import Source
- https://ftp.suse.com/pub/projects/security/osv/SUSE-SU-2021:3352-1.json
- JSON Data
- https://api.osv.dev/v1/vulns/SUSE-SU-2021:3352-1
- Related
- Published
- 2021-10-12T11:23:33Z
- Modified
- 2021-10-12T11:23:33Z
- Summary
- Security update for apache2-mod_auth_openidc
- Details
-
This update for apache2-modauthopenidc fixes the following issues:
- CVE-2021-32785: format string bug via hiredis (bsc#1188638)
- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)
- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)
- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)
- CVE-2021-39191: open redirect issue in targetlinkuri parameter (bsc#1190223)
- References
-
- https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/
- https://bugzilla.suse.com/1188638
- https://bugzilla.suse.com/1188639
- https://bugzilla.suse.com/1188848
- https://bugzilla.suse.com/1188849
- https://bugzilla.suse.com/1190223
- https://www.suse.com/security/cve/CVE-2021-32785
- https://www.suse.com/security/cve/CVE-2021-32786
- https://www.suse.com/security/cve/CVE-2021-32791
- https://www.suse.com/security/cve/CVE-2021-32792
- https://www.suse.com/security/cve/CVE-2021-39191
Affected packages
SUSE:Linux Enterprise Server 12 SP5 / apache2-mod_auth_openidc
Package
- Name
- apache2-mod_auth_openidc
- Purl
- pkg:rpm/suse/apache2-mod_auth_openidc&distro=SUSE%20Linux%20Enterprise%20Server%2012%20SP5