This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2021-32792 →

DEBIAN-CVE-2021-32792

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authentic...

Original description

The description as published by the source.

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, there is an XSS vulnerability in when using OIDCPreservePost On.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 libapache2-mod-auth-openidc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]

Debian:13 libapache2-mod-auth-openidc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]

Debian:14 libapache2-mod-auth-openidc

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.9-1"}]}]

References

advisory security-tracker.debian.org