Open redirect in mod_auth_openidc - CVE-2021-39191

Vulnerability identifier: #VU71703

CSH Severity: Low

CVSS v4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-39191

CWE-ID: CWE-601

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to redirect victims to arbitrary URL.

The vulnerability exists due to improper sanitization of user-supplied data. A remote attacker can create a link that leads to a trusted website, however, when clicked, redirects the victim to arbitrary domain.

Successful exploitation of this vulnerability may allow a remote attacker to perform a phishing attack and steal potentially sensitive information.

mod_auth_openidc
SUSE Manager Proxy
SUSE Manager Retail Branch Server
SUSE Manager Server
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
SUSE Linux Enterprise Server
SUSE Linux Enterprise Realtime Extension
SUSE Linux Enterprise Module for Server Applications
SUSE Linux Enterprise Server for SAP Applications
SUSE Linux Enterprise High Performance Computing
openSUSE Leap
Fedora
cjose
cjose-devel
mod_auth_openidc
apache2-mod_auth_openidc
apache2-mod_auth_openidc-debuginfo
apache2-mod_auth_openidc-debugsource

Install updates from vendor's website.

mod_auth_openidc - update to 2.4.9.4
cjose - update to 0.6.1-2
cjose-devel - update to 0.6.1-2
mod_auth_openidc - update to 2.3.7-11
apache2-mod_auth_openidc - addressed in versions 2.3.8-150100.3.22.1, 2.4.0-3.23.1
apache2-mod_auth_openidc-debuginfo - addressed in versions 2.3.8-150100.3.22.1, 2.4.0-3.23.1
apache2-mod_auth_openidc-debugsource - addressed in versions 2.3.8-150100.3.22.1, 2.4.0-3.23.1
mod_auth_openidc - addressed in versions 2.4.9.4-1.fc35, 2.4.9.4-1.fc36, 2.4.9.4-1.fc37, 2.4.12.3-2.fc39

• https://github.com/zmartzone/mod_auth_openidc/issues/672
• https://github.com/zmartzone/mod_auth_openidc/commit/03e6bfb446f4e3f27c003d30d6a433e5dd8e2b3d
• https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9.4
• https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-2pgf-8h6h-gqg2
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/32RGPW5LZDLDTB7MKZIGAHPSLFOUNWR5/
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RHXO4O4G2UQS7X6OQJCVZKHZAQ7SAIFB/

• Open redirect in ZmartZone IAM mod_auth_openidc Apache module
• SUSE update for apache2-mod_auth_openidc
• Fedora 39 update for mod_auth_openidc
• Red Hat Enterprise Linux 8 update for the mod_auth_openidc:2.3 module
• SUSE update for apache2-mod_auth_openidc
• Fedora 35 update for mod_auth_openidc
• Fedora 37 update for mod_auth_openidc
• Fedora 36 update for mod_auth_openidc
• Anolis OS update for mod_auth_openidc:2.3 module