CVE-2021-32785
Format string bug in the Redis cache implementation
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Format string bug in the Redis cache implementation
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
- Record
CVE-2021-32785- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-134
- Updated
- 2026-11-02
EUVDEUVD-2021-19548
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
- Record
EUVD-2021-19548- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-03
NVD
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
- Record
CVE-2021-32785- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
OSVAZL-6479
CVE-2021-32785 affecting package httpd for versions less than 2.4.52-1
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
- Record
AZL-6479- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSV
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
- Record
CVE-2021-32785- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-32785
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
- Record
DEBIAN-CVE-2021-32785- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 8 moreShow less
OSVUBUNTU-CVE-2021-32785
mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (OIDCCacheEncrypt off, OIDCSessionType server-cache, OIDCCacheType redis), mod_auth_openidc wrongly performed argument interpolation before passing Redis requests to hiredis, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the hiredis API. As a workaround, this vulnerability can be mitigated by setting OIDCCacheEncrypt to on, as cache keys are cryptographically hashed before use when this option is enabled.
- Record
UBUNTU-CVE-2021-32785- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2021-0452 No score
Updated apache-mod_auth_openidc packages fix security vulnerability
In versions prior to 2.4.9, oidc_validate_redirect_url() does not parse
URLs the same way as most browsers do. As a result, this function can be
bypassed and leads to an Open Redirect vulnerability in the logout
functionality. (CVE-2021-32786)
In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. (CVE-2021-32791)
In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in
when using OIDCPreservePost On. (CVE-2021-32792)
- Record
MGASA-2021-0452- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:1277-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2021-32785: format string bug via hiredis (bsc#1188638)
- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)
- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)
- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)
This update was imported from the SUSE:SLE-15-SP1:Update update project.
- Record
openSUSE-SU-2021:1277-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2021:3020-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2021-32785: format string bug via hiredis (bsc#1188638)
- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)
- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)
- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)
- Record
openSUSE-SU-2021:3020-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10624-1 No score
apache2-mod_auth_openidc-2.4.9.4-1.2 on GA media
These are all security issues fixed in the apache2-mod_auth_openidc-2.4.9.4-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10624-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3020-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2021-32785: format string bug via hiredis (bsc#1188638)
- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)
- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)
- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)
- Record
SUSE-SU-2021:3020-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:3352-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- CVE-2021-32785: format string bug via hiredis (bsc#1188638)
- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)
- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)
- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)
- CVE-2021-39191: open redirect issue in target_link_uri parameter (bsc#1190223)
- Record
SUSE-SU-2021:3352-1- Updated
- 2026-11-02
OSVSUSE-SU-2025:4532-1 No score
Security update for apache2-mod_auth_openidc
This update for apache2-mod_auth_openidc fixes the following issues:
- Update to 2.4.17.1 (bsc#1248806 / PED-14130).
- Remove many patches, as they've been merged upstream.
- Record
SUSE-SU-2025:4532-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
httpdAzure Linux:2 |
before 2.4.52-1 | 2.4.52-1 |
libapache2-mod-auth-openidcDebian:12 |
before 2.4.9-1 | 2.4.9-1 |
libapache2-mod-auth-openidcDebian:13 |
before 2.4.9-1 | 2.4.9-1 |
libapache2-mod-auth-openidcDebian:14 |
before 2.4.9-1 | 2.4.9-1 |
libapache2-mod-auth-openidcDebian:10 From an advisory covering 6 CVEs |
before 2.3.10.2-1+deb10u2, plus listed versions 2.3.10.2-12.3.10.2-1+deb10u1 |
2.3.10.2-1+deb10u2 |
apache-mod_auth_openidcMageia:8 From an advisory covering 4 CVEs |
before 2.4.9.4-1.mga8 | 2.4.9.4-1.mga8 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP2 From an advisory covering 4 CVEs |
before 2.3.8-3.15.1 | 2.3.8-3.15.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP3 From an advisory covering 4 CVEs |
before 2.3.8-3.15.1 | 2.3.8-3.15.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server 12 SP5 From an advisory covering 5 CVEs |
before 2.4.0-3.23.1 | 2.4.0-3.23.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Server for SAP Applications 12 SP5 From an advisory covering 5 CVEs |
before 2.4.0-3.23.1 | 2.4.0-3.23.1 |
Show 8 moreShow less
| Package | Affected | Fixed |
|---|---|---|
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP6 From an advisory covering 12 CVEs |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcSUSE:Linux Enterprise Module for Server Applications 15 SP7 From an advisory covering 12 CVEs |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.6 From an advisory covering 12 CVEs |
before 2.4.17.1-150600.16.14.1 | 2.4.17.1-150600.16.14.1 |
libapache2-mod-auth-openidcUbuntu:18.04:LTS |
All versions, plus listed versions 2.1.6-12.3.1-22.3.2-12.3.2-1build12.3.3-1build1 |
None known |
libapache2-mod-auth-openidcUbuntu:20.04:LTS |
All versions, plus listed versions 2.3.10.2-12.4.0.4-12.4.1-1 |
None known |
apache2-mod_auth_openidcopenSUSE:Leap 15.2 From an advisory covering 4 CVEs |
before 2.3.8-lp152.5.6.1 | 2.3.8-lp152.5.6.1 |
apache2-mod_auth_openidcopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 2.3.8-3.15.1 | 2.3.8-3.15.1 |
apache2-mod_auth_openidcopenSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 2.4.9.4-1.2 | 2.4.9.4-1.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-32785 is a medium vulnerability (CVSS 5.3) in Debian Linux, published July 22, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.73%, the 86th percentile. Fixed in httpd 2.4.52-1.
References
github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-55r8-6w97-xxr4
oracle.com/security-alerts/cpuapr2022.html
security.netapp.com/advisory/ntap-20210902-0001
lists.debian.org/debian-lts-announce/2023/04/msg00034.html
Show 31 moreShow less
nvd.nist.gov/vuln/detail/CVE-2021-32785
security-tracker.debian.org/tracker/CVE-2021-32785
advisories.mageia.org/MGASA-2021-0452.html
bugs.mageia.org/show_bug.cgi?id=29344
lists.fedoraproject.org/archives/list/[email protected]/thread/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU
lists.suse.com/pipermail/sle-security-updates/2021-September/009431.html
lists.opensuse.org/archives/list/[email protected]/thread/54B4RYNP5L63X2FMX2QCVYB2LGLL42IY
suse.com/support/update/announcement/2021/suse-su-20213020-1
bugzilla.suse.com/1188638
ubuntu.com/security/CVE-2021-32785
cve.org/CVERecord?id=CVE-2021-32785