{"id":"CVE-2019-14857","aliases":["ALSA-2020:3032","DEBIAN-CVE-2019-14857","DLA-1996-1","DLA-2298-1","EUVD-2019-5978","GHSA-797h-qjwj-28jc","MGASA-2019-0410","RHSA-2020:3032","RHSA-2020:3970","RLSA-2020:3032","SUSE-SU-2019:2934-1","SUSE-SU-2019:2935-1","SUSE-SU-2025:4532-1","UBUNTU-CVE-2019-14857","openSUSE-SU-2019:2499-1","openSUSE-SU-2024:10624-1"],"status":"published","title":"mod_auth_openidc before version 2.4.0.1 is vulnerable to a None","description":"A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.","severity":{"version":"3.0","score":5.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01598,"percentile":0.75977,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2019-11-08T12:17:52Z","modified":"2026-10-29T11:00:17Z","fixes":[{"ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.0.3-1"],"sources":["osv"]},{"ecosystem":"Debian:8","package":"libapache2-mod-auth-openidc","fixed_in":["1.6.0-1+deb8u2"],"sources":["osv"]},{"ecosystem":"Mageia:7","package":"apache-mod_auth_openidc","fixed_in":["2.3.2-2.1.mga7"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-3.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.7.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache2-mod_auth_openidc","fixed_in":["2.4.0-3.7.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.1","package":"apache2-mod_auth_openidc","fixed_in":["2.3.8-lp151.2.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.module_el8.6.0+2868+44838709"}]}],"bundled":2},{"source":"osv","ecosystem":"AlmaLinux:8","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.6.1-2.module_el8.6.0+2868+44838709"}]}],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0.3-1"}]}]},{"source":"osv","ecosystem":"Debian:8","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.0-1+deb8u2"}]}],"versions":["1.6.0-1","1.6.0-1+deb8u1"]},{"source":"osv","ecosystem":"Debian:9","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.6-1+deb9u1"}]}],"versions":["2.1.6-1"],"bundled":3},{"source":"osv","ecosystem":"Mageia:7","package":"apache-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.2-2.1.mga7"}]}]},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"cjose-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8+2454+f890a43a"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:8::appstream","package":"mod_auth_openidc-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.7-4.module+el8.2.0+6919+ac02cfd2.3"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.8-7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::server","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.8-7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.8-7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:enterprise_linux:7::workstation","package":"mod_auth_openidc-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.8.8-7.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Rocky Linux:8","package":"cjose","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.6.1-2.module+el8.3.0+129+2feafa46"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP1","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP4","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP4","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.7.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.6.0-1","1.8.5-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1","2.3.1-2","2.3.2-1","2.3.2-1build1","2.3.3-1build1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.1","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-lp151.2.3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1.2"}]}],"bundled":3}],"products":[{"vendor":"[unknown]","product":"mod_auth_openidc"},{"vendor":"openidc","product":"mod_auth_openidc"},{"vendor":"zmartzone","product":"mod_auth_openidc"}],"references":[{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14857","tags":["x_refsource_MISC","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/commit/ce37080c6aea30aabae8b4a9b4eea7808445cc8e","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/pull/451","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://groups.google.com/forum/#%21topic/mod_auth_openidc/boy1Ba3Gdk4","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://lists.debian.org/debian-lts-announce/2020/07/msg00028.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-14857","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!topic/mod_auth_openidc/boy1Ba3Gdk4","tags":["report"]},{"url":"https://github.com/advisories/GHSA-797h-qjwj-28jc"},{"url":"https://errata.almalinux.org/8/ALSA-2020-3032.html","tags":["advisory"]},{"url":"https://vulners.com/cve/CVE-2019-14857","tags":["report"]},{"url":"https://vulners.com/cve/CVE-2019-20479","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-14857","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2019-0410.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=25810","tags":["report"]},{"url":"https://lists.opensuse.org/opensuse-updates/2019-11/msg00078.html","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3032","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1760613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1805102","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1844107","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3032.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-14857","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-14857","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-20479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-20479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-20479","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2020:3970","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#low","tags":["article"]},{"url":"https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_3970.json","tags":["advisory"]},{"url":"https://errata.rockylinux.org/RLSA-2020:3032","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192934-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1153666","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14857","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2019/suse-su-20192935-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254532-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248806","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39191","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3891","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-14857","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/XSQ4PV6MSRCTP37A4LYZR5PQVS7FRJPW/#XSQ4PV6MSRCTP37A4LYZR5PQVS7FRJPW","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2019-14857","description":"A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.","status":"published","published":"2019-11-26T11:56:17Z","modified":"2024-08-05T00:26:39.151Z","cvss":[{"version":"3.0","score":5.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:20:17.722148Z"}],"euvd":[{"id":"EUVD-2019-5978","description":"A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.","status":"published","published":"2019-11-26T11:56:17Z","modified":"2024-08-05T00:26:39Z","cvss":[{"version":"3.0","score":5.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T02:40:38.166988Z"}],"ghsa":[{"id":"GHSA-797h-qjwj-28jc","title":"mod_auth_openidc before version 2.4.0.1 is vulnerable to a None","description":"mod_auth_openidc before version 2.4.0.1 is vulnerable to a None","status":"published","published":"2022-05-24T17:02:07Z","modified":"2023-06-03T05:00:53Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:54:37.773458Z"}],"nvd":[{"id":"CVE-2019-14857","description":"A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.","status":"published","published":"2019-11-26T12:15:10.807Z","modified":"2026-06-17T02:19:10.817Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.0","score":5.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-14857","description":"A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.","status":"published","published":"2019-11-26T12:15:10.807Z","modified":"2026-10-24T14:03:36.627161492Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.029493Z"},{"id":"DEBIAN-CVE-2019-14857","description":"A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.","status":"published","published":"2019-11-26T12:15:10.807Z","modified":"2026-09-21T07:01:33.684357293Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"RHSA-2020:3032","title":"Red Hat Security Advisory: mod_auth_openidc:2.3 security and bug fix update","status":"published","published":"2024-09-16T04:00:03Z","modified":"2025-11-22T12:05:11Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:07.072948Z"},{"id":"RHSA-2020:3970","title":"Red Hat Security Advisory: mod_auth_openidc security update","status":"published","published":"2024-09-16T04:00:13Z","modified":"2026-06-26T10:50:24Z","cvss":[{"version":"3.1","score":5.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:53:07.57369Z"},{"id":"RLSA-2020:3032","title":"Moderate: mod_auth_openidc:2.3 security and bug fix update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes (CVE-2019-14857)\n\n* mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash (CVE-2019-20479)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Module stream mod_auth_openidc:2.3 does not have correct module.md file (BZ#1844107)","status":"published","published":"2020-07-21T14:12:27Z","modified":"2026-02-05T09:30:13.665754Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:23.969672Z"},{"id":"UBUNTU-CVE-2019-14857","description":"A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.","status":"published","published":"2019-11-26T12:15:00Z","modified":"2025-10-24T04:47:46Z","cvss":[{"version":"3.0","score":5.8,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:19.6877Z"},{"id":"ALSA-2020:3032","title":"Moderate: mod_auth_openidc:2.3 security and bug fix update","description":"The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. \n\nSecurity Fix(es):\n\n* mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes (CVE-2019-14857)\n\n* mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash (CVE-2019-20479)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Module stream mod_auth_openidc:2.3 does not have correct module.md file (BZ#1844107)","status":"published","published":"2020-07-21T14:12:27Z","modified":"2026-10-29T11:00:17.179147156Z","updated_at":"2026-11-02T15:27:51.196609Z"},{"id":"DLA-1996-1","title":"libapache2-mod-auth-openidc - security update","status":"published","published":"2019-11-18T00:00:00Z","modified":"2026-03-09T01:19:05.714452Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"DLA-2298-1","title":"libapache2-mod-auth-openidc - security update","status":"published","published":"2020-07-29T00:00:00Z","modified":"2026-03-09T01:18:34.530998Z","updated_at":"2026-11-02T15:46:10.227108Z"},{"id":"MGASA-2019-0410","title":"Updated apache-mod_auth_openidc packages fix security vulnerability","description":"The updated package fixes a security vulnerability:\n\nA flaw was found in mod_auth_openidc before version 2.4.0.1. An open\nredirect issue exists in URLs with trailing slashes similar to\nCVE-2019-3877 in mod_auth_mellon. (CVE-2019-14857)\n","status":"published","published":"2019-12-25T19:08:41Z","modified":"2026-04-16T04:42:10.241099788Z","updated_at":"2026-11-02T15:49:41.151324Z"},{"id":"openSUSE-SU-2019:2499-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2019-14857: Fixed an open redirect issue that exists in URLs with trailing slashes (bsc#1153666).\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2019-11-13T15:20:41Z","modified":"2026-02-04T04:36:54.141804Z","updated_at":"2026-11-02T16:58:31.152112Z"},{"id":"openSUSE-SU-2024:10624-1","title":"apache2-mod_auth_openidc-2.4.9.4-1.2 on GA media","description":"These are all security issues fixed in the apache2-mod_auth_openidc-2.4.9.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:11:10.548475Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2019:2934-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2019-14857: Fixed an open redirect issue that exists in URLs with trailing slashes (bsc#1153666).\n","status":"published","published":"2019-11-08T12:17:52Z","modified":"2026-02-04T04:05:32.65547Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2019:2935-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2019-14857: Fixed an open redirect issue that exists in URLs with trailing slashes (bsc#1153666).\n","status":"published","published":"2019-11-08T12:18:01Z","modified":"2025-05-02T04:08:52.216367Z","updated_at":"2026-11-02T15:53:47.06185Z"},{"id":"SUSE-SU-2025:4532-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- Update to 2.4.17.1 (bsc#1248806 / PED-14130).\n- Remove many patches, as they've been merged upstream.\n  ","status":"published","published":"2025-12-29T13:53:59Z","modified":"2026-02-04T03:27:21.522575Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}