Debian LTS 2.4.9.4-0: DLA-4129-1 moderate: mod_auth_openidc security flaw
debian lts
April 17, 2025
A vulnerability has been fixed in mod_auth_openidc, an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Re...
Summary
The bug in mod_auth_openidc results in disclosure of protected content to
unauthenticated users.
The conditions for disclosure are the following directives:
OIDCProviderAuthRequestMethod POST
Require valid-user
and there mustn't be any application-level gateway (or load balancer etc)
protecting the server.
When you request a protected resource, the response includes the HTTP
status, the HTTP headers, the intended response (the self-submitting
form), *and the protected resource (with no headers)*.
The patch fixing this issue has been backported from mod_auth_openidc
2.4.16.11.
For Debian 11 bullseye, this problem has been fixed in version
2.4.9.4-0+deb11u5.
We recommend that you upgrade your libapache2-mod-auth-openidc packages.
For the detailed security status of libapache2-mod-auth-openidc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/source-package/libapache2-mod-auth-openidc
Further information about Debian LTS security advisories, how to apply
PREVIOUS
NEXT
Severity
important
Lowest
Low
Medium
High
Critical
Package: libapache2-mod-auth-openidc
Version: 2.4.9.4-0+deb11u5
CVE ID: CVE-2025-31492
Debian Bug: 1102413
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Related News
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!