< back to search

shield Security update for apache2-mod_auth_openidc

SUSE-SLE-Module-Server-Applications-15-SP3-2021-3020

This update for apache2-mod_auth_openidc fixes the following issues: - CVE-2021-32785: format string bug via hiredis (bsc#1188638) - CVE-2021-32786: open redirect in logout functionality (bsc#1188639) - CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849) - CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)

Release Date

Sep 13 2021
References

Bugzilla: 1188639, 1188638, 1188849, 1188848
CVEs: CVE-2021-32785, CVE-2021-32786, CVE-2021-32791, CVE-2021-32792
Type

security
Severity

moderate

cloud_download Downloads

To download packages, you need to log in and have a valid subscription.

Server Applications Module 15.3 ppc64le

Packages

apache2-mod_auth_openidc
Apache2.x module for an OpenID Connect enabled Identity Provider

2.3.8-3.15.1 lock rpm lock src

Server Applications Module 15.3 s390x

Packages

apache2-mod_auth_openidc
Apache2.x module for an OpenID Connect enabled Identity Provider

2.3.8-3.15.1 lock rpm lock src

Server Applications Module 15.3 x86_64

Packages

apache2-mod_auth_openidc
Apache2.x module for an OpenID Connect enabled Identity Provider

2.3.8-3.15.1 lock rpm lock src

Server Applications Module 15.3 aarch64

Packages

apache2-mod_auth_openidc
Apache2.x module for an OpenID Connect enabled Identity Provider

2.3.8-3.15.1 lock rpm lock src