CVE-2017-6062: High severity openidc Mod Auth Openidc vulnerability
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka modauthopenidc) module before 2.1.5 for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "OIDCUnAuthAction pass" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
apache/httpd/mod_auth_openidcto a version that resolves this vulnerability.Fixed in 2.1.5
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6062?
CVE-2017-6062 is classified as a medium severity vulnerability.
How do I fix CVE-2017-6062?
To fix CVE-2017-6062, upgrade the mod_auth_openidc module to version 2.1.5 or later.
What exploitation methods are associated with CVE-2017-6062?
CVE-2017-6062 can be exploited by remote attackers to bypass authentication using specially crafted OIDC_CLAIM_ and OIDCAuthNHeader headers.
Which versions are affected by CVE-2017-6062?
CVE-2017-6062 affects versions of mod_auth_openidc before 2.1.5.
What is the impact of CVE-2017-6062?
The impact of CVE-2017-6062 allows attackers to bypass authentication mechanisms, leading to unauthorized access.