ByteOS Network

NVD Vulnerability Details :

CVE-2021-32791

Modified

Source-security-advisories@github.com

Published At-26 Jul, 2021 | 17:15

Updated At-07 Nov, 2023 | 03:35

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

Date Added	Due Date	Vulnerability Name	Required Action
	N/A

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Secondary	3.1	5.9	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Primary	2.0	4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N

CPE Matches

openidc>>mod_auth_openidc>>Versions before 2.4.9(exclusive)

cpe:2.3:a:openidc:mod_auth_openidc:*:*:*:*:*:*:*:*

The Apache Software Foundation

>>http_server>>Versions from 2.0.0(inclusive) to 2.4.48(inclusive)

cpe:2.3:a:apache:http_server:*:*:*:*:*:*:*:*

Fedora Project

>>fedora>>33

cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*

Fedora Project

>>fedora>>34

cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-323	Primary	security-advisories@github.com
CWE-330	Primary	security-advisories@github.com
CWE-330	Secondary	nvd@nist.gov

References

Hyperlink	Source	Resource
https://github.com/zmartzone/mod_auth_openidc/commit/375407c16c61a70b56fdbe13b0d2c8f11398e92c	security-advisories@github.com	Patch Third Party Advisory
https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9	security-advisories@github.com	Release Notes Third Party Advisory
https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7j-3r9r	security-advisories@github.com	Patch Third Party Advisory
https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html	security-advisories@github.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU/	security-advisories@github.com	N/A
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXAWKPT5LXZSUTFSJ6IWSZC7RMYYQXQD/	security-advisories@github.com	N/A
https://www.oracle.com/security-alerts/cpuapr2022.html	security-advisories@github.com	Patch Third Party Advisory

CISA Catalog

Metrics

CPE Matches

Weaknesses

Evaluator Description

Evaluator Impact

Evaluator Solution

Vendor Statements

References

Change History