Red Hat Product Errata RHSA-2023:6940 - Security Advisory
Issued:
2023-11-14
Updated:
2023-11-14

RHSA-2023:6940 - Security Advisory

Synopsis

Moderate: mod_auth_openidc:2.3 security and bug fix update

Type/Severity

Security Advisory: Moderate

Red Hat Lightspeed patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for the mod_auth_openidc:2.3 module is now available for Red Hat Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

  • mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character (CVE-2022-23527)
  • mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied (CVE-2023-28625)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.9 Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

  • BZ - 2072469 - Random memory overwrite
  • BZ - 2141850 - auth_openidc.conf probably should be mode 0640 by default
  • BZ - 2153655 - CVE-2022-23527 mod_auth_openidc: Open Redirect in oidc_validate_redirect_url() using tab character
  • BZ - 2184118 - CVE-2023-28625 mod_auth_openidc: NULL pointer dereference when OIDCStripCookies is set and a crafted Cookie header is supplied

Red Hat Enterprise Linux for x86_64 8

SRPM
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.src.rpm SHA-256: 35330ac8fa43f98837e718da93964930553a735424168b0b46148e38fce0a106
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.src.rpm SHA-256: d97a38c89884763df3f613d3d048766929a04efe78f09aeda32699c028df7097
x86_64
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.x86_64.rpm SHA-256: 1c243c2cccef08c7321f2967ca2023b0d064e72ccc0c4cdc562ea8fa7c47ddf4
cjose-debuginfo-0.6.1-4.module+el8.9.0+19469+5b493da9.x86_64.rpm SHA-256: 8a36117dea08080dabe6b750c3713c7a639d0e42f1ef0672c265363f39b36297
cjose-debugsource-0.6.1-4.module+el8.9.0+19469+5b493da9.x86_64.rpm SHA-256: d3487edce0aec8937a94c1f508704a9cf6bc351bf3ad857447257df418c5184b
cjose-devel-0.6.1-4.module+el8.9.0+19469+5b493da9.x86_64.rpm SHA-256: 5870bff897ebcf64553dbb88de84a7d0f5393b8ade37a288529c7a6f09e2658b
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.x86_64.rpm SHA-256: 1a4898d2f41b48a2cb62f66efcbc95da6c983608305f866fa8d3d574b01ff711
mod_auth_openidc-debuginfo-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.x86_64.rpm SHA-256: 987b4d7ddd2077291f793cc4ea925f365206e7a383cf1eb181be6c1958912adf
mod_auth_openidc-debugsource-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.x86_64.rpm SHA-256: 33ee2fd10fb2570eae7d11235544abe204c4ff9a9aebbae4db88d8b6d5dc7dd1

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.src.rpm SHA-256: 35330ac8fa43f98837e718da93964930553a735424168b0b46148e38fce0a106
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.src.rpm SHA-256: d97a38c89884763df3f613d3d048766929a04efe78f09aeda32699c028df7097
s390x
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.s390x.rpm SHA-256: 57bdb63eaab5f10c9252431f80a70845b2f3b5f4f7d648ae56f88d3c9e5b4cd5
cjose-debuginfo-0.6.1-4.module+el8.9.0+19469+5b493da9.s390x.rpm SHA-256: 43adb941ea950aa38031924c42d76fbd4dad0dbccbcb33985ab833b7587b88b1
cjose-debugsource-0.6.1-4.module+el8.9.0+19469+5b493da9.s390x.rpm SHA-256: 87466f40075e45d46a48b3badf6d7ceac514fbbcff0baa7edef6db7320517899
cjose-devel-0.6.1-4.module+el8.9.0+19469+5b493da9.s390x.rpm SHA-256: fe5f93591dd74c12ab9f2fcac23be5a2804e22aba2911a8e6df6b08d527f2379
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.s390x.rpm SHA-256: 6806a3e30ff9a7e4ca6d5ca601067c767e1900a5025fad8a14f1f07abb447d45
mod_auth_openidc-debuginfo-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.s390x.rpm SHA-256: 6d92320b6888ef7457c7c0c48e08f4840b0374c642d60d1aa0509e632f9505fb
mod_auth_openidc-debugsource-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.s390x.rpm SHA-256: e174c13e56e4651ef42d523fbb68e814e9a1d8bf71a920a6e243e56a088506fc

Red Hat Enterprise Linux for Power, little endian 8

SRPM
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.src.rpm SHA-256: 35330ac8fa43f98837e718da93964930553a735424168b0b46148e38fce0a106
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.src.rpm SHA-256: d97a38c89884763df3f613d3d048766929a04efe78f09aeda32699c028df7097
ppc64le
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.ppc64le.rpm SHA-256: 47bb5a13a18a5db0ed52afbf467247c1a5711b3b93b81722d2cee3251cdde30d
cjose-debuginfo-0.6.1-4.module+el8.9.0+19469+5b493da9.ppc64le.rpm SHA-256: ce65e9976bfb5645582edab3c236907b6b7c1de2493967a77d9d38b1d836ca5f
cjose-debugsource-0.6.1-4.module+el8.9.0+19469+5b493da9.ppc64le.rpm SHA-256: 8883db82f293d4b427f8233f0a976478f49309fa9d8f0fe3e3948ad3f2361578
cjose-devel-0.6.1-4.module+el8.9.0+19469+5b493da9.ppc64le.rpm SHA-256: 7801210143b59f02d7ba8258bf50ebae8d79c934f6cd9f8dd5bec56aedd75290
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.ppc64le.rpm SHA-256: 0516dd736567b90765db772e92d67102039d58d017de5afe0abdc96d904ea89b
mod_auth_openidc-debuginfo-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.ppc64le.rpm SHA-256: fd8c731858d293f5856e006edaddf46abdab4843526b3e4e3307ed1ebccef24b
mod_auth_openidc-debugsource-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.ppc64le.rpm SHA-256: a16933e437d360ec6e6d8326e398ac20e1570feff7213ebcefe3c2b29ba655bd

Red Hat Enterprise Linux for ARM 64 8

SRPM
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.src.rpm SHA-256: 35330ac8fa43f98837e718da93964930553a735424168b0b46148e38fce0a106
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.src.rpm SHA-256: d97a38c89884763df3f613d3d048766929a04efe78f09aeda32699c028df7097
aarch64
cjose-0.6.1-4.module+el8.9.0+19469+5b493da9.aarch64.rpm SHA-256: 77383d29ec3d8bbc3be843aef4838edc5e09db8a674a0f08ab82dfcb231e0edb
cjose-debuginfo-0.6.1-4.module+el8.9.0+19469+5b493da9.aarch64.rpm SHA-256: dc09508649a6adea6bdba4658912a584a8bec21145da3d2eb79ef6f997d97588
cjose-debugsource-0.6.1-4.module+el8.9.0+19469+5b493da9.aarch64.rpm SHA-256: fc9536feb6f97f461af828bd74c60289452d99a2e2ca3325ea1844036d32f733
cjose-devel-0.6.1-4.module+el8.9.0+19469+5b493da9.aarch64.rpm SHA-256: 8489ef8dcbfd2a9ba151c762366d3fb3db15514d54d7e88a36173a3e60c50500
mod_auth_openidc-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.aarch64.rpm SHA-256: 49ec0b9a8e7150dcca01043b70f5786c6852d5f9ba23e493f165ff883eef8066
mod_auth_openidc-debuginfo-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.aarch64.rpm SHA-256: abca0fa1e87c9347817f83dea1e98142055c1f1457647a24736c74202730b9a3
mod_auth_openidc-debugsource-2.4.9.4-5.module+el8.9.0+18723+672ccf5d.aarch64.rpm SHA-256: 0a4ffaedddb7ca28d1dad5b6616ba5a7751a9eeb0d51ea23de116837214ca294

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.