PT-2021-4478 · Hiredis+4 · Hiredis+4

Published 2021-07-22 · Updated 2025-12-29 · CVE-2021-32785

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.9

Description The issue is related to the use of uncontrolled format strings in mod auth openidc when configured to use an unencrypted Redis cache. This can lead to a denial of service by repeatedly crashing the Apache workers. The bug is caused by mod auth openidc performing argument interpolation before passing Redis requests to hiredis, which performs it again. The estimated impact and real-world incidents are not specified.

Recommendations For mod auth openidc versions prior to 2.4.9, update to version 2.4.9 to resolve the issue. As a temporary workaround, consider setting OIDCCacheEncrypt to on to mitigate the vulnerability, as cache keys are cryptographically hashed before use when this option is enabled.

Fix

DoS

Use of Externally-Controlled Format String

Weakness Enumeration

CWE-134

Related Identifiers

AZL-6479

BDU:2021-05111

CVE-2021-32785

DLA-3409-1

GHSA-55R8-6W97-XXR4

MGASA-2021-0452

OPENSUSE-SU-2021:1277-1

OPENSUSE-SU-2021:3020-1

OPENSUSE-SU-2021_1277-1

OPENSUSE-SU-2021_3020-1

OPENSUSE-SU-2024:10624-1

SUSE-SU-2021:3020-1

SUSE-SU-2021:3352-1

SUSE-SU-2021_3020-1

SUSE-SU-2021_3352-1

SUSE-SU-2025:4532-1

Affected Products

Apache

Redis

Suse

Hiredis

Mod Auth Openidc

References · 55

• https://github.com/zmartzone/mod_auth_openidc/commit/dc672688dc1f2db7df8ad4abebc367116017a449 · Patch
• https://cve.org/CVERecord?id=CVE-2021-32785 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2021:1277-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32785 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-05111 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:3352-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3020-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32785 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32785 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4532-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:10624-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-32785 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2021:3020-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0452.html · Security Note