ELSA-2022-1823

ELSA-2022-1823 - mod_auth_openidc:2.3 security update

Type:	SECURITY
Severity:	MODERATE
Release Date:	2022-05-17

Description

cjose
[0.6.1-2]
- fix concatkdf big endian architecture problem.
Upstream issue #77.

[0.6.1-1]
- upgrade to latest upstream 0.6.1

[0.5.1-3]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_29_Mass_Rebuild

[0.5.1-2]
- Rebuilt for https://fedoraproject.org/wiki/Fedora_28_Mass_Rebuild

[0.5.1-1]
- Initial packaging

mod_auth_openidc
[2.3.7-11]
- Resolves: rhbz#1987222 - CVE-2021-32792 XSS when using OIDCPreservePost On

[2.3.7-10]
- Resolves: rhbz#1987216 - CVE-2021-32791 hardcoded static IV and AAD with a
reused key in AES GCM encryption [rhel-8] (edit)

[2.3.7-9]
- Resolves: rhbz#2001853 - CVE-2021-39191 open redirect by supplying a crafted URL
in the target_link_uri parameter

Related CVEs

CVE-2021-32786

CVE-2021-32791

CVE-2021-32792

CVE-2021-39191

Updated Packages

Release/Architecture	Filename	MD5sum	Superseded By Advisory
Oracle Linux 8 (aarch64)	cjose-0.6.1-2.module+el8+5139+bcb28322.src.rpm	1cc167d14b0f3f03da82d7a14f4f763a	-
	mod_auth_openidc-2.3.7-11.module+el8.6.0+20572+b6f23e95.src.rpm	8966af8758b9076913da3dd81e1cc274	-
	cjose-0.6.1-2.module+el8+5139+bcb28322.aarch64.rpm	133688f63419961809f191751ceac9ba	-
	cjose-devel-0.6.1-2.module+el8+5139+bcb28322.aarch64.rpm	de2a21ff00acf4b8c6b8f773fcb6cf5e	-
	mod_auth_openidc-2.3.7-11.module+el8.6.0+20572+b6f23e95.aarch64.rpm	541700be696593118a770535dc6a7cc6	-
Oracle Linux 8 (x86_64)	cjose-0.6.1-2.module+el8+5139+bcb28322.src.rpm	1cc167d14b0f3f03da82d7a14f4f763a	-
	mod_auth_openidc-2.3.7-11.module+el8.6.0+20572+b6f23e95.src.rpm	8966af8758b9076913da3dd81e1cc274	-
	cjose-0.6.1-2.module+el8+5139+bcb28322.x86_64.rpm	23c6745a452b98ed3be8819511c84376	-
	cjose-devel-0.6.1-2.module+el8+5139+bcb28322.x86_64.rpm	0eac675499d2e7532f5d378c111bdc08	-
	mod_auth_openidc-2.3.7-11.module+el8.6.0+20572+b6f23e95.x86_64.rpm	4d9ac5b41cc58ed537596f8c83e1e3b7	-

This page is generated automatically and has not been checked for errors or omissions. For clarification or corrections please contact the Oracle Linux ULN team