CVE-2017-6413: High severity openidc Mod Auth Openidc vulnerability
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka modauthopenidc) module before 2.1.6 for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
Other sources
The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka modauthopenidc) module for the Apache HTTP Server does not skip OIDCCLAIM and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.
External References:
https://github.com/pingidentity/modauthopenidc/releases/tag/v2.1.6
Upstream patch:
https://github.com/pingidentity/modauthopenidc/commit/21e3728a825c41ab41efa75e664108051bb9665e
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/mod_auth_openidcto a version that resolves this vulnerability.Fixed in 2.1.6 - Upgrade
Upgrade
pingidentity/mod_auth_openidcto a version that resolves this vulnerability.Fixed in 2.1.6Patch 21e3728a825c41ab41efa75e664108051bb9665e
Event History
Frequently Asked Questions
What is the severity of CVE-2017-6413?
CVE-2017-6413 has been classified as a medium severity vulnerability.
How do I fix CVE-2017-6413?
To fix CVE-2017-6413, upgrade the mod_auth_openidc module to version 2.1.6 or later.
What causes the vulnerability CVE-2017-6413?
CVE-2017-6413 is caused by the mod_auth_openidc module not properly skipping certain headers in an oauth20 configuration.
Who is affected by CVE-2017-6413?
CVE-2017-6413 affects users of the mod_auth_openidc module version prior to 2.1.6 on Apache HTTP Server.
What is the impact of CVE-2017-6413?
The impact of CVE-2017-6413 allows remote attackers to bypass authentication, potentially leading to unauthorized access.