{"id":"CVE-2021-32785","aliases":["AZL-6479","DEBIAN-CVE-2021-32785","DLA-3409-1","EUVD-2021-19548","GHSA-55r8-6w97-xxr4","MGASA-2021-0452","SUSE-SU-2021:3020-1","SUSE-SU-2021:3352-1","SUSE-SU-2025:4532-1","UBUNTU-CVE-2021-32785","openSUSE-SU-2021:1277-1","openSUSE-SU-2021:3020-1","openSUSE-SU-2024:10624-1"],"status":"published","title":"Format string bug in the Redis cache implementation","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.02731,"percentile":0.86213,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-134"],"published":"2021-07-22T00:00:00Z","modified":"2026-10-24T10:50:12Z","fixes":[{"ecosystem":"Azure Linux:2","package":"httpd","fixed_in":["2.4.52-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","fixed_in":["2.4.9-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:2","package":"httpd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.52-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.10.2-1+deb10u2"}]}],"versions":["2.3.10.2-1","2.3.10.2-1+deb10u1"],"bundled":6},{"source":"osv","ecosystem":"Mageia:8","package":"apache-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP2","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP5","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0-3.23.1"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP7","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.17.1-150600.16.14.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.6-1","2.3.1-2","2.3.2-1","2.3.2-1build1","2.3.3-1build1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"libapache2-mod-auth-openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.3.10.2-1","2.4.0.4-1","2.4.1-1"]},{"source":"osv","ecosystem":"openSUSE:Leap 15.2","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-lp152.5.6.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.8-3.15.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"apache2-mod_auth_openidc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9.4-1.2"}]}],"bundled":3}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"netapp","product":"cloud_backup"},{"vendor":"openidc","product":"mod_auth_openidc"},{"vendor":"zmartzone","product":"mod_auth_openidc"}],"references":[{"url":"https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-55r8-6w97-xxr4","tags":["x_transferred","Mitigation","Third Party Advisory","advisory","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/commit/dc672688dc1f2db7df8ad4abebc367116017a449","tags":["x_transferred","Patch","Third Party Advisory","fix","report"]},{"url":"https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9","tags":["x_transferred","Release Notes","Third Party Advisory","advisory","report"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://security.netapp.com/advisory/ntap-20210902-0001/","tags":["x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-32785","tags":["web"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-32785","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2021-0452.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29344","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-September/009431.html","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/54B4RYNP5L63X2FMX2QCVYB2LGLL42IY/","tags":["web","advisory"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213020-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1188638","tags":["report"]},{"url":"https://bugzilla.suse.com/1188639","tags":["report"]},{"url":"https://bugzilla.suse.com/1188848","tags":["report"]},{"url":"https://bugzilla.suse.com/1188849","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32785","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32786","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32791","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-32792","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2021/suse-su-20213352-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1190223","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-39191","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-20254532-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1248806","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-14857","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-20479","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28625","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-24814","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-31492","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3891","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-32785","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-32785","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4FGDDGUNYC724M4QGEPJORKASFRVKJ5V/","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-32785","title":"Format string bug in the Redis cache implementation","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","status":"published","published":"2021-07-22T00:00:00Z","modified":"2024-08-03T23:33:55.913Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:33:06.658806Z"}],"euvd":[{"id":"EUVD-2021-19548","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","status":"published","published":"2021-07-22T00:00:00Z","modified":"2024-08-03T23:33:55Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-03T03:24:35.855495Z"}],"nvd":[{"id":"CVE-2021-32785","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","status":"published","published":"2021-07-22T22:15:08.14Z","modified":"2026-06-17T03:53:37.5Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-134"],"updated_at":"2026-11-02T14:06:56.185362Z"}],"osv":[{"id":"AZL-6479","title":"CVE-2021-32785 affecting package httpd for versions less than 2.4.52-1","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","status":"published","published":"2021-07-22T22:15:08Z","modified":"2026-04-21T04:32:33.876573Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:08.076947Z"},{"id":"CVE-2021-32785","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","status":"published","published":"2021-07-22T22:15:08.14Z","modified":"2026-10-24T10:50:12.232109693Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.793849Z"},{"id":"DEBIAN-CVE-2021-32785","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","status":"published","published":"2021-07-22T22:15:08.14Z","modified":"2026-10-23T18:03:14.210013049Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:35.233346Z"},{"id":"UBUNTU-CVE-2021-32785","description":"mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. When mod_auth_openidc versions prior to 2.4.9 are configured to use an unencrypted Redis cache (`OIDCCacheEncrypt off`, `OIDCSessionType server-cache`, `OIDCCacheType redis`), `mod_auth_openidc` wrongly performed argument interpolation before passing Redis requests to `hiredis`, which would perform it again and lead to an uncontrolled format string bug. Initial assessment shows that this bug does not appear to allow gaining arbitrary code execution, but can reliably provoke a denial of service by repeatedly crashing the Apache workers. This bug has been corrected in version 2.4.9 by performing argument interpolation only once, using the `hiredis` API. As a workaround, this vulnerability can be mitigated by setting `OIDCCacheEncrypt` to `on`, as cache keys are cryptographically hashed before use when this option is enabled.","status":"published","published":"2021-07-22T22:15:00Z","modified":"2025-10-24T04:50:20Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:27.332852Z"},{"id":"DLA-3409-1","title":"libapache2-mod-auth-openidc - security update","status":"published","published":"2023-04-30T00:00:00Z","modified":"2026-03-09T01:22:41.48677Z","updated_at":"2026-11-02T15:46:11.734021Z"},{"id":"MGASA-2021-0452","title":"Updated apache-mod_auth_openidc packages fix security vulnerability","description":"In versions prior to 2.4.9, `oidc_validate_redirect_url()` does not parse\nURLs the same way as most browsers do. As a result, this function can be\nbypassed and leads to an Open Redirect vulnerability in the logout\nfunctionality. (CVE-2021-32786)\n\nIn mod_auth_openidc before version 2.4.9, the AES GCM encryption in\nmod_auth_openidc uses a static IV and AAD. It is important to fix because\nthis creates a static nonce and since aes-gcm is a stream cipher, this can\nlead to known cryptographic issues, since the same key is being reused.\n(CVE-2021-32791)\n\nIn mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in\nwhen using `OIDCPreservePost On`. (CVE-2021-32792)\n","status":"published","published":"2021-10-02T18:57:04Z","modified":"2026-04-16T04:42:45.726594338Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2021:1277-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n\nThis update was imported from the SUSE:SLE-15-SP1:Update update project.","status":"published","published":"2021-09-16T10:07:24Z","modified":"2026-02-04T04:06:51.553747Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2021:3020-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n","status":"published","published":"2021-09-13T07:17:23Z","modified":"2025-05-07T18:12:52.60292Z","updated_at":"2026-11-02T16:58:32.266854Z"},{"id":"openSUSE-SU-2024:10624-1","title":"apache2-mod_auth_openidc-2.4.9.4-1.2 on GA media","description":"These are all security issues fixed in the apache2-mod_auth_openidc-2.4.9.4-1.2 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:11:10.548475Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"SUSE-SU-2021:3020-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n","status":"published","published":"2021-09-13T07:17:22Z","modified":"2026-02-04T03:53:51.602295Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2021:3352-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- CVE-2021-32785: format string bug via hiredis (bsc#1188638)\n- CVE-2021-32786: open redirect in logout functionality (bsc#1188639)\n- CVE-2021-32791: Hardcoded static IV and AAD with a reused key in AES GCM encryption (bsc#1188849)\n- CVE-2021-32792: XSS when using OIDCPreservePost On (bsc#1188848)\n- CVE-2021-39191: open redirect issue in target_link_uri parameter (bsc#1190223)\n","status":"published","published":"2021-10-12T11:23:33Z","modified":"2025-05-02T04:10:41.445092Z","updated_at":"2026-11-02T15:53:49.605187Z"},{"id":"SUSE-SU-2025:4532-1","title":"Security update for apache2-mod_auth_openidc","description":"This update for apache2-mod_auth_openidc fixes the following issues:\n\n- Update to 2.4.17.1 (bsc#1248806 / PED-14130).\n- Remove many patches, as they've been merged upstream.\n  ","status":"published","published":"2025-12-29T13:53:59Z","modified":"2026-02-04T03:27:21.522575Z","updated_at":"2026-11-02T15:54:00.846737Z"}]}}