Bug 2361633 (CVE-2025-3891)
| Summary: | CVE-2025-3891 mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | aogburn, carnil, hans.zandbelt, prodsec-dev, schlarbm, security-response-team |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | Flags: | carnil:
needinfo?
(prodsec-dev) |
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in the mod_auth_openidc module for Apache httpd. This flaw allows a remote, unauthenticated attacker to trigger a denial of service by sending an empty POST request when the OIDCPreservePost directive is enabled. The server crashes consistently, affecting availability.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2025-04-22 11:20:41 UTC
Hi Can you share details about this CVE assiignment? According to the Debian maintainer and upstream of the project they were not informed about this issue and as well cannot reproduce crashes, cf. https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104484#10 Can you please elaborate? Regards, Salvatore This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2025:4597 https://access.redhat.com/errata/RHSA-2025:4597 Note this is not an issue with upstream mod_auth_openidc 2.4.13.2+ where the issue has already been addressed by https://github.com/OpenIDC/mod_auth_openidc/commit/29ea79dea97cdab1b0d150af2c9a50a442e7216e. Upstream here: thanks for the details on this CVE. Apparently it is not an empty POST request that causes the crash but rather a missing Content-Type header, as the link to the patch commit also shows. Affected versions are >= 2.0.0 and <= 2.4.13.1, see the newly created advisory on Github - based on this issue - here: https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2025:9396 https://access.redhat.com/errata/RHSA-2025:9396 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2025:10002 https://access.redhat.com/errata/RHSA-2025:10002 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2025:10006 https://access.redhat.com/errata/RHSA-2025:10006 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2025:10008 https://access.redhat.com/errata/RHSA-2025:10008 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Via RHSA-2025:10004 https://access.redhat.com/errata/RHSA-2025:10004 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2025:10003 https://access.redhat.com/errata/RHSA-2025:10003 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2025:10010 https://access.redhat.com/errata/RHSA-2025:10010 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2025:10007 https://access.redhat.com/errata/RHSA-2025:10007 |