PT-2019-4786 · Apache+5 · Mod Auth Openidc+6

Oss-Aimoto · Published 2019-11-08 · Updated 2025-12-29 · CVE-2019-14857

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.0.1 Apache HTTP Server (affected versions not specified)

Description A flaw exists related to open redirect issues in URLs with trailing slashes. There is also an issue with insufficient protection of web pages in the mod auth digest component of the Apache HTTP Server, which could allow a remote attacker to gain unauthorized access to confidential information or execute arbitrary code.

Recommendations For mod auth openidc versions prior to 2.4.0.1, update to version 2.4.0.1 or later. For Apache HTTP Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALSA-2020:3032

BDU:2020-01364

CESA-2020_3032

CESA-2020_3970

CVE-2019-14857

DLA-1996-1

DLA-2298-1

MGASA-2019-0410

OPENSUSE-SU-2019:2499-1

OPENSUSE-SU-2019_2499-1

OPENSUSE-SU-2024:10624-1

RHSA-2020:3032

RHSA-2020:3970

RHSA-2020_3032

RHSA-2020_3970

RLSA-2020:3032

SUSE-SU-2019:2934-1

SUSE-SU-2019:2935-1

SUSE-SU-2019_2934-1

SUSE-SU-2019_2935-1

SUSE-SU-2025:4532-1

Affected Products

Almalinux

Apache Http Server

Centos

Red Hat

Rocky Linux

Suse

Mod Auth Openidc

References · 57

• https://github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75 · Patch
• https://github.com/zmartzone/mod_auth_openidc/commit/ce37080c6aea30aabae8b4a9b4eea7808445cc8e · Patch
• https://github.com/zmartzone/mod_auth_openidc/pull/451 · Patch
• https://osv.dev/vulnerability/RLSA-2020:3032 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2019:2935-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-3970.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-14857 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-14857 · Security Note
• https://bdu.fstec.ru/vul/2020-01364 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2025:4532-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10624-1 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2020:3032 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0410.html · Security Note
• https://security-tracker.debian.org/tracker/CVE-2019-14857 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-14857 · Vendor Advisory