PT-2021-6452 · Unknown+5 · Mod Auth Openidc+5

Published 2021-06-10 · Updated 2025-12-29 · CVE-2021-32791

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.9

Description The issue is related to the AES GCM encryption in mod auth openidc, which uses a static IV and AAD. This creates a static nonce and can lead to known cryptographic issues since the same key is being reused. The problem allows a remote attacker to access confidential data.

Recommendations For mod auth openidc versions prior to 2.4.9, update to version 2.4.9 or later, which uses dynamic values through the usage of cjose AES encryption routines to fix the issue. As a temporary workaround, consider restricting access to sensitive data until the update can be applied.

Fix

Use of Insufficiently Random Values

Weakness Enumeration

CWE-323

CWE-330

Related Identifiers

ALSA-2022:1823

AZL-6481

BDU:2022-01657

CESA-2022_1823

CVE-2021-32791

DLA-3409-1

GHSA-PX3C-6X7J-3R9R

MGASA-2021-0452

OPENSUSE-SU-2021:1277-1

OPENSUSE-SU-2021:3020-1

OPENSUSE-SU-2021_1277-1

OPENSUSE-SU-2021_3020-1

RHSA-2022:1823

RHSA-2022_1823

RLSA-2022:1823

SUSE-SU-2021:3020-1

SUSE-SU-2021:3352-1

SUSE-SU-2025:4532-1

Affected Products

Almalinux

Centos

Red Hat

Rocky Linux

Suse

Mod Auth Openidc

References · 69

• https://github.com/zmartzone/mod_auth_openidc/commit/375407c16c61a70b56fdbe13b0d2c8f11398e92c · Patch
• https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7j-3r9r · Patch
• https://osv.dev/vulnerability/openSUSE-SU-2021:1277-1 · Vendor Advisory
• https://osv.dev/vulnerability/RLSA-2022:1823 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-32791 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2021:3020-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:3352-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-32791 · Vendor Advisory
• https://osv.dev/vulnerability/ALSA-2022:1823 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/FZVF6BSJLRQZ7PFFR4X5JSU6KUJYNOCU · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-32791 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4532-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-32791 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-32791 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXAWKPT5LXZSUTFSJ6IWSZC7RMYYQXQD · Vendor Advisory