| Summary: | apache-mod_auth_openidc new security issue CVE-2019-14857 | ||
|---|---|---|---|
| Product: | Mageia | Reporter: | David Walser <luigiwalser> |
| Component: | Security | Assignee: | QA Team <qa-bugs> |
| Status: | RESOLVED FIXED | QA Contact: | Sec team <security> |
| Severity: | critical | ||
| Priority: | Normal | CC: | herman.viaene, nicolas.salguero, sysadmin-bugs, tmb |
| Version: | 7 | Keywords: | advisory, validated_update |
| Target Milestone: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | MGA7-64-OK | ||
| Source RPM: | apache-mod_auth_openidc-2.3.2-2.mga7.src.rpm | CVE: | CVE-2019-14857 |
| Status comment: | |||
|
Description
David Walser
2019-12-03 21:13:40 CET
David Walser
2019-12-03 21:13:52 CET
Whiteboard:
(none) =>
MGA7TOO Assigning globally as there is no maintainer, official or otherwise. Assignee:
bugsquad =>
pkg-bugs Suggested advisory: ======================== The updated package fixes a security vulnerability: A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon. (CVE-2019-14857) References: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14857 https://lists.opensuse.org/opensuse-updates/2019-11/msg00078.html ======================== Updated package in core/updates_testing: ======================== apache-mod_auth_openidc-2.3.2-2.1.mga7 from SRPMS: apache-mod_auth_openidc-2.3.2-2.1.mga7.src.rpm Version:
Cauldron =>
7 MGA7-64 Plasma on Lenovo B50
No installation issues
After installation at CLI:
# systemctl -l status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
Active: inactive (dead)
# systemctl start httpd
# systemctl -l status httpd
● httpd.service - The Apache HTTP Server
Loaded: loaded (/usr/lib/systemd/system/httpd.service; disabled; vendor preset: disabled)
Active: active (running) since Mon 2019-12-16 10:56:49 CET; 3s ago
Main PID: 23335 (httpd)
Status: "Processing requests..."
Memory: 11.5M
CGroup: /system.slice/httpd.service
├─23335 /usr/sbin/httpd -DFOREGROUND
├─23337 /usr/sbin/httpd -DFOREGROUND
├─23338 /usr/sbin/httpd -DFOREGROUND
├─23339 /usr/sbin/httpd -DFOREGROUND
├─23341 /usr/sbin/httpd -DFOREGROUND
└─23343 /usr/sbin/httpd -DFOREGROUND
dec 16 10:56:49 mach5.hviaene.thuis systemd[1]: Starting The Apache HTTP Server...
dec 16 10:56:49 mach5.hviaene.thuis systemd[1]: Started The Apache HTTP Server.
And pointing firefox to localhost gets me "It works!"
Trying to find some test on the specific update gets me to foreign territories.
I will not object OK on clean instal.CC:
(none) =>
herman.viaene
Thomas Backlund
2019-12-25 19:46:05 CET
CC:
(none) =>
tmb, sysadmin-bugs An update for this issue has been pushed to the Mageia Updates repository. https://advisories.mageia.org/MGASA-2019-0410.html Status:
ASSIGNED =>
RESOLVED |