Candidate: CVE-2021-32786
PublicDate: 2021-07-22 22:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32786
 https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-xm4c-5wm5-jqv7
 https://github.com/zmartzone/mod_auth_openidc/commit/3a115484eb927bc6daa5737dd84f88ff4bbc5544 (v2.4.9)
 https://daniel.haxx.se/blog/2017/01/30/one-url-standard-please/
 https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9
 https://github.com/zmartzone/mod_auth_openidc/commit/3a115484eb927bc6daa5737dd84f88ff4bbc5544
Description:
 mod_auth_openidc is an authentication/authorization module for the Apache
 2.x HTTP server that functions as an OpenID Connect Relying Party,
 authenticating users against an OpenID Connect Provider. In versions prior
 to 2.4.9, `oidc_validate_redirect_url()` does not parse URLs the same way
 as most browsers do. As a result, this function can be bypassed and leads
 to an Open Redirect vulnerability in the logout functionality. This bug has
 been fixed in version 2.4.9 by replacing any backslash of the URL to
 redirect with slashes to address a particular breaking change between the
 different specifications (RFC2396 / RFC3986 and WHATWG). As a workaround,
 this vulnerability can be mitigated by configuring `mod_auth_openidc` to
 only allow redirection whose destination matches a given regular
 expression.
Ubuntu-Description:
Notes:
Mitigation:
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]


Patches_libapache2-mod-auth-openidc:
upstream_libapache2-mod-auth-openidc: released (2.4.9-1)
trusty_libapache2-mod-auth-openidc: ignored (out of standard support)
trusty/esm_libapache2-mod-auth-openidc: DNE
xenial_libapache2-mod-auth-openidc: ignored (out of standard support)
bionic_libapache2-mod-auth-openidc: not-affected (code not present)
focal_libapache2-mod-auth-openidc: not-affected (code not present)
hirsute_libapache2-mod-auth-openidc: ignored (reached end-of-life)
impish_libapache2-mod-auth-openidc: not-affected (2.4.9-1)
jammy_libapache2-mod-auth-openidc: not-affected (2.4.9-1)
devel_libapache2-mod-auth-openidc: not-affected (2.4.9-1)