CVE catalog

CVE-2021-32791

libapache2-mod-auth-openidc: CVE-2021-32791

[CVE catalog]

Severity
Medium · CVSS 5.9CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Published
Source
[NVD] · [CVE record]
EPSS
1.50% · Oct 25, 2026

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibapache2-mod-auth-openidcsid2.4.20.3-1fixed
Debianlibapache2-mod-auth-openidcforky2.4.20.3-1fixed
Debianlibapache2-mod-auth-openidctrixie2.4.17-1fixed
Debianlibapache2-mod-auth-openidctrixie-security2.4.17-1+deb13u1fixed
Debianlibapache2-mod-auth-openidcbookworm2.4.12.3-2+deb12u4fixed
Debianlibapache2-mod-auth-openidcbookworm-security2.4.12.3-2+deb12u5fixed
Ubuntulibapache2-mod-auth-openidc18.042.1.6-1vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.1-2vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.2-1vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.2-1build1vulnerable
Ubuntulibapache2-mod-auth-openidc18.042.3.3-1build1vulnerable
Ubuntulibapache2-mod-auth-openidc20.042.3.10.2-1vulnerable
Ubuntulibapache2-mod-auth-openidc20.042.4.0.4-1vulnerable
Ubuntulibapache2-mod-auth-openidc20.042.4.1-1vulnerable

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibapache2-mod-auth-openidcsourcesid2.4.9-1not yet assignedNot reported[991581]
Debianlibapache2-mod-auth-openidcsourceforky2.4.9-1not yet assignedNot reported[991581]
Debianlibapache2-mod-auth-openidcsourcetrixie2.4.9-1not yet assignedNot reported[991581]
Debianlibapache2-mod-auth-openidcsourcebookworm2.4.9-1not yet assignedNot reported[991581]

[Debian bug #991581]

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

  • [libapache2-mod-auth-openidc]Unknown
    Details (4)

    • 2.4.12.3-2+deb12u4 · amd64 · bookworm

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

    • 2.4.12.3-2+deb12u4 · arm64 · bookworm

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

    • 2.4.12.3-2+deb12u4 · amd64 · bookworm-security

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

    • 2.4.12.3-2+deb12u4 · arm64 · bookworm-security

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · bookworm; dsa · libapache2-mod-auth-openidc · debian · 12

[Debian 13 (Trixie)]

  • [libapache2-mod-auth-openidc]Unknown
    Details (3)

    • 2.4.17-1 · amd64 · trixie

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · 13

    • 2.4.17-1 · arm64 · trixie

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · 13

    • 2.4.17-1+deb13u1 · amd64 · trixie-security

      Fixed · Fixed: 2.4.9-1

      dsa · libapache2-mod-auth-openidc · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]