Fedora has issued an advisory today (August 8):
The issues are fixed upstream in 2.4.9.
Mageia 8 is also affected.
Fixed upstream in 2.4.9Whiteboard:
Assigning to all packagers collectively, because I haven't seen mitya since three years ago.
feel free to reassign to yourself :-)
The updated package fixes security vulnerabilities:
In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. (CVE-2021-32786)
In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. (CVE-2021-32791)
In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`. (CVE-2021-32792)
Updated package in core/updates_testing:
Fixed upstream in 2.4.9 =>
CVE-2021-32786, CVE-2021-32791, CVE-2021-32792Version:
SUSE has issued an advisory for this today (September 13):
One additional issue, CVE-2021-32785, was also fixed upstream in 2.4.9.
It should be added to the advisory.
apache-mod_auth_openidc new security issues CVE-2021-32786 and CVE-2021-3279 =>
apache-mod_auth_openidc new security issues CVE-2021-3278 and CVE-2021-3279
(In reply to David Walser from comment #3)
> SUSE has issued an advisory for this today (September 13):
> One additional issue, CVE-2021-32785, was also fixed upstream in 2.4.9.
> It should be added to the advisory.
Equivalent openSUSE advisory: