Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-32791

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

Published

2021-07-26T17:15:08.100

Last Modified

2024-11-21T06:07:44.937

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

CVSSv2 Vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

  • Access Vector: NETWORK
  • Access Complexity: MEDIUM
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: NONE
  • Availability Impact: NONE
Exploitability Score

8.6

Impact Score

2.9

Weaknesses
  • Type: Secondary
    CWE-323
    CWE-330
  • Type: Primary
    CWE-330
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application openidc mod_auth_openidc < 2.4.9 Yes
Application apache http_server ≤ 2.4.48 No
Operating System fedoraproject fedora 33 Yes
Operating System fedoraproject fedora 34 Yes
References