Security update for apache2-mod_auth_openidc SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2023:0215-1 Final 1 1 2023-01-30T16:27:28Z current 2023-01-30T16:27:28Z 2023-01-30T16:27:28Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for apache2-mod_auth_openidc This update for apache2-mod_auth_openidc fixes the following issues: - CVE-2022-23527: Fixed open redirect in oidc_validate_redirect_url() using tab character (bsc#1206441). - CVE-2021-39191: Fixed open redirect issue in target_link_uri parameter (bsc#1190223). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2023-215,SUSE-SLE-Module-Server-Applications-15-SP4-2023-215,SUSE-SLE-Product-RT-15-SP3-2023-215,openSUSE-SLE-15.4-2023-215 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2023/suse-su-20230215-1/ Link for SUSE-SU-2023:0215-1 https://lists.suse.com/pipermail/sle-security-updates/2023-January/013592.html E-Mail link for SUSE-SU-2023:0215-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1190223 SUSE Bug 1190223 https://bugzilla.suse.com/1199868 SUSE Bug 1199868 https://bugzilla.suse.com/1206441 SUSE Bug 1206441 https://www.suse.com/security/cve/CVE-2021-39191/ SUSE CVE CVE-2021-39191 page https://www.suse.com/security/cve/CVE-2022-23527/ SUSE CVE CVE-2022-23527 page SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Real Time 15 SP3 openSUSE Leap 15.4 apache2-mod_auth_openidc-2.3.8-150100.3.22.1 apache2-mod_auth_openidc-2.3.8-150100.3.22.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 apache2-mod_auth_openidc-2.3.8-150100.3.22.1 as a component of SUSE Linux Enterprise Real Time 15 SP3 apache2-mod_auth_openidc-2.3.8-150100.3.22.1 as a component of openSUSE Leap 15.4 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In versions prior to 2.4.9.4, the 3rd-party init SSO functionality of mod_auth_openidc was reported to be vulnerable to an open redirect attack by supplying a crafted URL in the `target_link_uri` parameter. A patch in version 2.4.9.4 made it so that the `OIDCRedirectURLsAllowed` setting must be applied to the `target_link_uri` parameter. There are no known workarounds aside from upgrading to a patched version. CVE-2021-39191 SUSE Linux Enterprise Module for Server Applications 15 SP4:apache2-mod_auth_openidc-2.3.8-150100.3.22.1 SUSE Linux Enterprise Real Time 15 SP3:apache2-mod_auth_openidc-2.3.8-150100.3.22.1 openSUSE Leap 15.4:apache2-mod_auth_openidc-2.3.8-150100.3.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230215-1/ https://www.suse.com/security/cve/CVE-2021-39191.html CVE-2021-39191 https://bugzilla.suse.com/1190223 SUSE Bug 1190223 mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed. CVE-2022-23527 SUSE Linux Enterprise Module for Server Applications 15 SP4:apache2-mod_auth_openidc-2.3.8-150100.3.22.1 SUSE Linux Enterprise Real Time 15 SP3:apache2-mod_auth_openidc-2.3.8-150100.3.22.1 openSUSE Leap 15.4:apache2-mod_auth_openidc-2.3.8-150100.3.22.1 moderate To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2023/suse-su-20230215-1/ https://www.suse.com/security/cve/CVE-2022-23527.html CVE-2022-23527 https://bugzilla.suse.com/1206441 SUSE Bug 1206441