Fedora Account System
Red Hat Associate
Red Hat Customer
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process. mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.
Hello, Thank you for maintaining mod_auth_openidc in Fedora. I’ve prepared a small backport of the upstream fix for CVE-2026-54789 and would like to offer it for Fedora 43 and 44. CVE-2026-54789 is an out-of-bounds read and one-byte out-of-bounds write in the state-cookie parser. When the module looks for the "=" in a cookie whose name starts with the state-cookie prefix, the loop only stops at "=" (its NULL check can never trigger). An unauthenticated client can send such a cookie without "=", making the parser read past the end of the string and write a NUL byte wherever it finds the next "=". This happens before any session or state validation and can crash the httpd worker. Fedora 43 and 44 both ship 2.4.19.2 and are affected. Fedora 45 (2.4.19.4) and Rawhide (2.4.20.3) already include the fix. The attached patch is the one-line code change from upstream commit 8017478471cc: https://github.com/OpenIDC/mod_auth_openidc/commit/8017478471cc071c49aa073c5c9be652a73a8630 The loop now also stops at the end of the string, so a token without "=" is skipped. Upstream's ChangeLog entry and new unit test are not included (2.4.19.2 has no test/test_state.c). AI assistance was used to prepare this patch and its validation. The resulting changes and validation results were reviewed by a human. Would you consider applying it to Fedora 43 and 44? I’m happy to adjust the backport if you’d prefer a different approach for the stable branches.
Created attachment 2161370 [details] backport of upstream patch