mod_auth_openidc vulnerabilities (Rocky Linux)
13 vulnerabilities.
-
mod_auth_openidcRocky Linux OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption 9.1 Critical -
mod_auth_openidcRocky Linux OpenIDC/cjose has a heap buffer overflow in AES Key Wrap decryption (A128KW/A192KW/A256KW) 8.2 High -
mod_auth_openidcRocky Linux mod_auth_openidc has out-of-bounds read and write in state cookie parsing 7.5 High -
mod_auth_openidcRocky Linux Mod_auth_openidc: dos via empty post in mod_auth_openidc with oidcpreservepost enabled 7.5 High -
mod_auth_openidcRocky Linux mod_auth_openidc allows OIDCProviderAuthRequestMethod POSTs to leak protected data 8.2 High -
mod_auth_openidcRocky Linux Denial of service when manipulating mod_auth_openidc_session_chunks cookie in mod_auth_openidc 7.5 High -
mod_auth_openidcRocky Linux Incorrect Authentication Tag length usage in AES GCM decryption in OpenIDC/cjose 8.6 High -
mod_auth_openidcRocky Linux mod_auth_openidc core dump when OIDCStripCookies is set and an empty Cookie header is supplied 7.5 High -
mod_auth_openidcRocky Linux Open Redirect in oidc_validate_redirect_url() 4.7 Medium -
mod_auth_openidcRocky Linux URL Redirection to Untrusted Site ('Open Redirect') in mod_auth_openidc 4.7 Medium -
mod_auth_openidcRocky Linux XSS vulnerability when using OIDCPreservePost On in mod_auth_openidc 3.1 Low -
mod_auth_openidcRocky Linux Hardcoded static IV and AAD with a reused key in AES GCM encryption in mod_auth_openidc 5.9 Medium -
mod_auth_openidcRocky Linux Open Redirect in oidc_validate_redirect_url() 4.7 Medium