Server-side request forgery (SSRF) In libapache2-mod-auth-openidc
Description
mod_auth_openidc is an OpenID Certified™ authentication and authorization module for the Apache 2.x HTTP server. Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a logout parameter to the redirect URI, the existing code in oidc_validate_redirect_url() does not properly check for URLs that start with /\t, leading to an open redirect. This issue has been patched in version 2.4.12.2. Users unable to upgrade can mitigate the issue by configuring mod_auth_openidc to only allow redirection when the destination matches a given regular expression with OIDCRedirectURLsAllowed.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 11 | 2.4.9.4-0+deb11u2 | ||
debian 12 | 2.4.12.2-1 | ||
debian 13 | 2.4.12.2-1 | ||
debian 14 | 2.4.12.2-1 | ||
 rpm rhel8 | 0:2.4.9.4-5.module+el8.9.0+18723+672ccf5d | ||
rpm rhel9 | 0:2.4.9.4-4.el9 | ||
rpm rhel7 | - | - |
Aliases