Important: mod_auth_openidc:2.3 security update

2023-08-0100:00:00

errata.almalinux.org

mod_auth_openidc

apache http server

openid connect

oauth 2.0

cjose

aes gcm

cve-2023-37464

security update

8.6 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

48.9%

JSON

The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Security Fix(es):

cjose: AES GCM decryption uses the Tag length from the actual Authentication Tag provided in the JWE (CVE-2023-37464)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

OSVersionArchitecturePackageVersionFilename
almalinux8aarch64cjose< 0.6.1-3.module_el8.8.0+3591+c9939da8cjose-0.6.1-3.module_el8.8.0+3591+c9939da8.aarch64.rpm
almalinux8aarch64cjose-devel< 0.6.1-3.module_el8.8.0+3591+c9939da8cjose-devel-0.6.1-3.module_el8.8.0+3591+c9939da8.aarch64.rpm
almalinux8aarch64mod_auth_openidc< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.aarch64.rpm
almalinux8x86_64cjose-devel< 0.6.1-3.module_el8.8.0+3591+c9939da8cjose-devel-0.6.1-3.module_el8.8.0+3591+c9939da8.x86_64.rpm
almalinux8x86_64cjose< 0.6.1-3.module_el8.8.0+3591+c9939da8cjose-0.6.1-3.module_el8.8.0+3591+c9939da8.x86_64.rpm
almalinux8x86_64mod_auth_openidc< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.x86_64.rpm
almalinux8ppc64lemod_auth_openidc< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.ppc64le.rpm
almalinux8ppc64lecjose-devel< 0.6.1-3.module_el8.8.0+3591+c9939da8cjose-devel-0.6.1-3.module_el8.8.0+3591+c9939da8.ppc64le.rpm
almalinux8ppc64lecjose< 0.6.1-3.module_el8.8.0+3591+c9939da8cjose-0.6.1-3.module_el8.8.0+3591+c9939da8.ppc64le.rpm
almalinux8s390xmod_auth_openidc< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.s390x.rpm

OS	Version	Architecture	Package	Version	Filename
almalinux	8	aarch64	cjose	< 0.6.1-3.module_el8.8.0+3591+c9939da8	cjose-0.6.1-3.module_el8.8.0+3591+c9939da8.aarch64.rpm
almalinux	8	aarch64	cjose-devel	< 0.6.1-3.module_el8.8.0+3591+c9939da8	cjose-devel-0.6.1-3.module_el8.8.0+3591+c9939da8.aarch64.rpm
almalinux	8	aarch64	mod_auth_openidc	< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3	mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.aarch64.rpm
almalinux	8	x86_64	cjose-devel	< 0.6.1-3.module_el8.8.0+3591+c9939da8	cjose-devel-0.6.1-3.module_el8.8.0+3591+c9939da8.x86_64.rpm
almalinux	8	x86_64	cjose	< 0.6.1-3.module_el8.8.0+3591+c9939da8	cjose-0.6.1-3.module_el8.8.0+3591+c9939da8.x86_64.rpm
almalinux	8	x86_64	mod_auth_openidc	< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3	mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.x86_64.rpm
almalinux	8	ppc64le	mod_auth_openidc	< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3	mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.ppc64le.rpm
almalinux	8	ppc64le	cjose-devel	< 0.6.1-3.module_el8.8.0+3591+c9939da8	cjose-devel-0.6.1-3.module_el8.8.0+3591+c9939da8.ppc64le.rpm
almalinux	8	ppc64le	cjose	< 0.6.1-3.module_el8.8.0+3591+c9939da8	cjose-0.6.1-3.module_el8.8.0+3591+c9939da8.ppc64le.rpm
almalinux	8	s390x	mod_auth_openidc	< 2.4.9.4-1.module_el8.7.0+3305+9a59f0c3	mod_auth_openidc-2.4.9.4-1.module_el8.7.0+3305+9a59f0c3.s390x.rpm