Security update for apache2-mod_auth_openidc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2021:3352-1 Final 1 1 2021-10-12T11:23:33Z current 2021-10-12T11:23:33Z 2021-10-12T11:23:33Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2-mod_auth_openidc This update for apache2-mod_auth_openidc fixes the following issues: - CVE-2021-32785: format string bug via hiredis (bsc#1188638) - CVE-2021-32786: open redirect in logout functionality (bsc#1188639) - CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849) - CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848) - CVE-2021-39191: open redirect issue in target_link_uri parameter (bsc#1190223) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2021-3352,SUSE-SLE-SERVER-12-SP5-2021-3352 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/ Link for SUSE-SU-2021:3352-1 https://lists.suse.com/pipermail/sle-security-updates/2021-October/009576.html E-Mail link for SUSE-SU-2021:3352-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1188638 SUSE Bug 1188638 https://bugzilla.suse.com/1188639 SUSE Bug 1188639 https://bugzilla.suse.com/1188848 SUSE Bug 1188848 https://bugzilla.suse.com/1188849 SUSE Bug 1188849 https://bugzilla.suse.com/1190223 SUSE Bug 1190223 https://www.suse.com/security/cve/CVE-2021-32785/ SUSE CVE CVE-2021-32785 page https://www.suse.com/security/cve/CVE-2021-32786/ SUSE CVE CVE-2021-32786 page https://www.suse.com/security/cve/CVE-2021-32791/ SUSE CVE CVE-2021-32791 page https://www.suse.com/security/cve/CVE-2021-32792/ SUSE CVE CVE-2021-32792 page https://www.suse.com/security/cve/CVE-2021-39191/ SUSE CVE CVE-2021-39191 page SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-mod_auth_openidc-2.4.0-3.23.1 apache2-mod_auth_openidc-2.4.0-3.23.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-mod_auth_openidc-2.4.0-3.23.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled. CVE-2021-32785 SUSE Linux Enterprise Server 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/ https://www.suse.com/security/cve/CVE-2021-32785.html CVE-2021-32785 https://bugzilla.suse.com/1188638 SUSE Bug 1188638 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. This bug has been fixed in version 2.4.9 by replacing any backslash of the URL to redirect with slashes to address a particular breaking change between the different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround, this vulnerability can be mitigated by configuring `mod_auth_openidc` to only allow redirection whose destination matches a given regular expression. CVE-2021-32786 SUSE Linux Enterprise Server 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/ https://www.suse.com/security/cve/CVE-2021-32786.html CVE-2021-32786 https://bugzilla.suse.com/1188639 SUSE Bug 1188639 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines. CVE-2021-32791 SUSE Linux Enterprise Server 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/ https://www.suse.com/security/cve/CVE-2021-32791.html CVE-2021-32791 https://bugzilla.suse.com/1188849 SUSE Bug 1188849 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`. CVE-2021-32792 SUSE Linux Enterprise Server 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/ https://www.suse.com/security/cve/CVE-2021-32792.html CVE-2021-32792 https://bugzilla.suse.com/1188848 SUSE Bug 1188848 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version. CVE-2021-39191 SUSE Linux Enterprise Server 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/ https://www.suse.com/security/cve/CVE-2021-39191.html CVE-2021-39191 https://bugzilla.suse.com/1190223 SUSE Bug 1190223