Количество 12
Количество 12
CVE-2021-32786
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
CVE-2021-32786
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
CVE-2021-32786
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression.
CVE-2021-32786
CVE-2021-32786
mod_auth_openidc is an authentication/authorization module for the Apa ...
BDU:2022-01677
Уязвимость функции oidc_validate_redirect_url() модуля аутентификации и авторизации для Apache 2.x HTTP server Mod_auth_openidc, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность
openSUSE-SU-2021:3020-1
Security update for apache2-mod_auth_openidc
openSUSE-SU-2021:1277-1
Security update for apache2-mod_auth_openidc
SUSE-SU-2021:3020-1
Security update for apache2-mod_auth_openidc
RLSA-2022:1823
Moderate: mod_auth_openidc:2.3 security update
ELSA-2022-1823
ELSA-2022-1823: mod_auth_openidc:2.3 security update (MODERATE)
SUSE-SU-2021:3352-1
Security update for apache2-mod_auth_openidc
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2021-32786 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression. | CVSS3: 4.7 | 0% Низкий | около 4 лет назад |
 | CVE-2021-32786 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression. | CVSS3: 6.1 | 0% Низкий | около 4 лет назад |
 | CVE-2021-32786 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression. | CVSS3: 4.7 | 0% Низкий | около 4 лет назад |
 | CVSS3: 6.1 | 0% Низкий | больше 3 лет назад | |
| CVE-2021-32786 mod_auth_openidc is an authentication/authorization module for the Apa ... | CVSS3: 4.7 | 0% Низкий | около 4 лет назад |
 | BDU:2022-01677 Уязвимость функции oidc_validate_redirect_url() модуля аутентификации и авторизации для Apache 2.x HTTP server Mod_auth_openidc, позволяющая нарушителю получить доступ к конфиденциальным данным и нарушить их целостность | CVSS3: 6.1 | 0% Низкий | больше 8 лет назад |
 | openSUSE-SU-2021:3020-1 Security update for apache2-mod_auth_openidc | почти 4 года назад | ||
| openSUSE-SU-2021:1277-1 Security update for apache2-mod_auth_openidc | почти 4 года назад | ||
| SUSE-SU-2021:3020-1 Security update for apache2-mod_auth_openidc | почти 4 года назад | ||
 | RLSA-2022:1823 Moderate: mod_auth_openidc:2.3 security update | около 3 лет назад | ||
| ELSA-2022-1823 ELSA-2022-1823: mod_auth_openidc:2.3 security update (MODERATE) | около 3 лет назад | ||
| SUSE-SU-2021:3352-1 Security update for apache2-mod_auth_openidc | почти 4 года назад |
Уязвимостей на страницу