Bug 1428855 (CVE-2017-6413)

Summary:	CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and OIDCAuthNHeader not skipped in an "AuthType oauth20" configuration
Product:	[Other] Security Response	Reporter:	Andrej Nemec <anemec>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED WONTFIX	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	jdennis, jpazdziora, puiterwijk
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	mod_auth_openidc 2.1.6	Doc Type:	If docs needed, set a value
Doc Text:	It was found that mod_auth_openidc did not properly sanitize HTTP headers for certain request paths. A remote attacker could potentially use this flaw to bypass authentication and access sensitive information by sending crafted HTTP requests.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-05-29 07:42:06 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1425356, 1626297
Bug Blocks:	1425355

Description Andrej Nemec 2017-03-03 14:05:24 UTC

The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module for the Apache HTTP Server does not skip OIDC_CLAIM_ and OIDCAuthNHeader headers in an "AuthType oauth20" configuration, which allows remote attackers to bypass authentication via crafted HTTP traffic.

External References:

https://github.com/pingidentity/mod_auth_openidc/releases/tag/v2.1.6

Upstream patch:

https://github.com/pingidentity/mod_auth_openidc/commit/21e3728a825c41ab41efa75e664108051bb9665e

Comment 1 Andrej Nemec 2017-03-03 14:25:56 UTC

Created mod_auth_openidc tracking bugs for this issue:

Affects: fedora-all [bug 1425356]

Comment 5 errata-xmlrpc 2019-08-06 12:15:40 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2019:2112 https://access.redhat.com/errata/RHSA-2019:2112