libapache2-mod-auth-openidc: CVE-2022-23527

Debian Bug report logs - #1026444
libapache2-mod-auth-openidc: CVE-2022-23527

Reply or subscribe to this bug.

Toggle useless messages

Message #5 received at submit@bugs.debian.org (full text, mbox, reply):

From: Moritz Schlarb <schlarbm@uni-mainz.de>

To: Debian Bug Tracking System <submit@bugs.debian.org>

Subject: libapache2-mod-auth-openidc: CVE-2022-23527

Date: Tue, 20 Dec 2022 12:33:51 +0100

Source: libapache2-mod-auth-openidc
Severity: important
Tags: patch upstream security
X-Debbugs-Cc: Debian Security Team <team@security.debian.org>

Versions prior to 2.4.12.2 are vulnerable to Open Redirect. When providing a
logout parameter to the redirect URI, the existing code in
oidc_validate_redirect_url() does not properly check for URLs that start with
/\t, leading to an open redirect. This issue has been patched in version
2.4.12.2. Users unable to upgrade can mitigate the issue by configuring
mod_auth_openidc to only allow redirection when the destination matches a given
regular expression with OIDCRedirectURLsAllowed.

https://security-tracker.debian.org/tracker/CVE-2022-23527

https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-q6f2-285m-gr53

https://github.com/zmartzone/mod_auth_openidc/commit/87119f44b9a88312dbc1f752d720bcd2371b94a8


-- System Information:
Debian Release: bookworm/sid
  APT prefers testing
  APT policy: (990, 'testing'), (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)

Kernel: Linux 6.0.0-5-amd64 (SMP w/8 CPU threads; PREEMPT)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE not set
Shell: /bin/sh linked to /usr/bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Send a report that this bug log contains spam.