MGASA-2021-0452: apache-mod_auth_openidc Mageia

CVSS: UnknownPublished
Published 02-10-2021Last modified 16-04-2026
Open JSON

Vulnerability summary

MGASA-2021-0452 is a vulnerability in apache-mod_auth_openidc Mageia with no CVSS score yet.

Overall risk
0/100
0100
Minimal · default modelHow is this calculated?
CVSS score
Not scored
010
No CVSS score recorded
EPSS score
Not scored
0%100%
No EPSS score yet
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 4 · Downstream 0
CVE-2021-32785CVE-2021-32786CVE-2021-32791CVE-2021-32792

Timeline

  1. 02-10-2021
    PublishedVulnerability first disclosed.
  2. 16-04-2026
    Last modifiedVulnerability information updated.

Description

Updated apache-mod_auth_openidc packages fix security vulnerability In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way as most browsers do. As a result, this function can be bypassed and leads to an Open Redirect vulnerability in the logout functionality. (CVE-2021-32786) In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. (CVE-2021-32791) In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using `OIDCPreservePost On`. (CVE-2021-32792)

CVSS metrics

Risk metrics not yet published.

EPSS trend

No EPSS score has been published for this record yet.

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Mageia1 product
  • apache-mod_auth_openidc< 2.4.9.4-1.mga8

1 vendor · 1 product

References

5 links