PT-2021-4074 · Unknown+1 · Mod Auth Openidc+1

Published 2021-04-30 · Updated 2023-05-25 · CVE-2021-20718

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mod auth openidc versions 2.4.0 through 2.4.7

Description The issue is related to an uncontrolled consumption of resources, which can be exploited by a remote attacker to cause a denial-of-service (DoS) condition. The exact vectors used for the exploitation are not specified.

Recommendations For mod auth openidc versions 2.4.0 through 2.4.7, update to a version outside of this range to resolve the issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

AZL-7288

BDU:2021-04650

CVE-2021-20718

MGASA-2021-0280

SUSE-SU-2021:1900-1

SUSE-SU-2021_1900-1

Affected Products

Suse

Mod Auth Openidc

References · 29

• https://osv.dev/vulnerability/AZL-7288 · Vendor Advisory
• https://zmartzone.eu · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FV4KYMQWPS3I2QPW2C253MLIAFGBZPLK · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-20718 · Security Note
• https://osv.dev/vulnerability/MGASA-2021-0280 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HJK366TLFEOIYWTHQSZO24MSDPBXHJU · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/5HJK366TLFEOIYWTHQSZO24MSDPBXHJU · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:1900-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-20718 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04650 · Security Note
• https://osv.dev/vulnerability/CVE-2021-20718 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-20718 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-20718 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-20718 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-20718 · Security Note