Advisory ROSA-SA-2021-1922

Software: mod_auth_openidc 1.8.8
OS: Cobalt 7.9

CVE-ID: CVE-2017-6062
CVE-Crit: HIGH
CVE-DESC: The “OpenID Connect Verification Party and OAuth 2.0 Resource Server” module (also known as mod_auth_openidc) before version 2.1.5 for Apache HTTP Server does not pass the OIDC_CLAIM_ and OIDCAuthNHeader headers in the “OIDCUnAuthAction pass-through” configuration, allowing remote attackers to bypass authentication through the generated HTTP traffic.
CVE-STATUS: default
CVE-REV: default

CVE-ID: CVE-2019-1010247
CVE-Crit: MEDIUM
CVE-DESC: ZmartZone IAM mod_auth_openidc 2.3.10.1 and earlier versions are prone to: cross-site scripting (XSS). Consequences: redirecting user to phishing page or interacting with application on behalf of user. Component: File: src / mod_auth_openidc.c, line: 3109. Fixed Version: 2.3.10.2.
CVE-STATUS: default
CVE-REV: default