Vulnerability Description
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Openidc | Mod Auth Openidc | < 2.4.9 |
| Apache | Http Server | >= 2.0.0, <= 2.4.48 |
| Fedoraproject | Fedora | 33 |
Related Weaknesses (CWE)
References
- https://github.com/zmartzone/mod_auth_openidc/commit/375407c16c61a70b56fdbe13b0dPatchThird Party Advisory
- https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9Release NotesThird Party Advisory
- https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7jPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
- https://github.com/zmartzone/mod_auth_openidc/commit/375407c16c61a70b56fdbe13b0dPatchThird Party Advisory
- https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9Release NotesThird Party Advisory
- https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7jPatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://www.oracle.com/security-alerts/cpuapr2022.htmlPatchThird Party Advisory
FAQ
What is CVE-2021-32791?
CVE-2021-32791 is a vulnerability with a CVSS score of 5.9 (MEDIUM). mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In...
How severe is CVE-2021-32791?
CVE-2021-32791 has been rated MEDIUM with a CVSS base score of 5.9/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-32791?
Check the references section above for vendor advisories and patch information. Affected products include: Openidc Mod Auth Openidc, Apache Http Server, Fedoraproject Fedora.