-------------------------------------------------------------------------
Debian LTS Advisory DLA-4129-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Moritz Schlarb
April 17, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------
Package : libapache2-mod-auth-openidc
Version : 2.4.9.4-0+deb11u5
CVE ID : CVE-2025-31492
Debian Bug : 1102413
A vulnerability has been fixed in mod_auth_openidc, an OpenID Certified
authentication and authorization module for the Apache 2.x HTTP server
that implements the OpenID Connect Relying Party functionality.
The bug in mod_auth_openidc results in disclosure of protected content to
unauthenticated users.
The conditions for disclosure are the following directives:
OIDCProviderAuthRequestMethod POST
Require valid-user
and there mustn't be any application-level gateway (or load balancer etc)
protecting the server.
When you request a protected resource, the response includes the HTTP
status, the HTTP headers, the intended response (the self-submitting
form), *and the protected resource (with no headers)*.
The patch fixing this issue has been backported from mod_auth_openidc
2.4.16.11.
For Debian 11 bullseye, this problem has been fixed in version
2.4.9.4-0+deb11u5.
We recommend that you upgrade your libapache2-mod-auth-openidc packages.
For the detailed security status of libapache2-mod-auth-openidc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
Attachment:
signature.asc
Description: This is a digitally signed message part