Bug 2361633 (CVE-2025-3891) - CVE-2025-3891 mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with OIDCPreservePost Enabled [NEEDINFO]
Summary: CVE-2025-3891 mod_auth_openidc: DoS via Empty POST in mod_auth_openidc with O...
Keywords:
Status: NEW
Alias: CVE-2025-3891
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-04-22 11:20 UTC by OSIDB Bzimport
Modified: 2025-06-23 15:54 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:
carnil: needinfo? (prodsec-dev)


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2025:4597 0 None None None 2025-05-06 20:16:06 UTC
Red Hat Product Errata RHSA-2025:9396 0 None None None 2025-06-23 15:54:47 UTC

Description OSIDB Bzimport 2025-04-22 11:20:41 UTC
An unauthenticated attacker can crash the Apache httpd process by sending an empty POST request when OIDCPreservePost is enabled in mod_auth_openidc. This leads to denial of service.

Comment 3 Salvatore Bonaccorso 2025-05-02 12:34:28 UTC
Hi

Can you share details about this CVE assiignment? 

According to the Debian maintainer and upstream of the project they were not informed about this issue and as well cannot reproduce crashes, cf.
https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1104484#10

Can you please elaborate?

Regards,
Salvatore

Comment 4 errata-xmlrpc 2025-05-06 20:16:04 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2025:4597 https://access.redhat.com/errata/RHSA-2025:4597

Comment 5 Aaron Ogburn 2025-05-06 21:07:16 UTC
Note this is not an issue with upstream mod_auth_openidc 2.4.13.2+ where the issue has already been addressed by https://github.com/OpenIDC/mod_auth_openidc/commit/29ea79dea97cdab1b0d150af2c9a50a442e7216e.

Comment 6 Hans Zandbelt 2025-05-07 05:29:01 UTC
Upstream here: thanks for the details on this CVE. Apparently it is not an empty POST request that causes the crash but rather a missing Content-Type header, as the link to the patch commit also shows. Affected versions are >= 2.0.0 and <= 2.4.13.1, see the newly created advisory on Github - based on this issue - here: https://github.com/OpenIDC/mod_auth_openidc/security/advisories/GHSA-x7cf-8wgv-5j86

Comment 7 errata-xmlrpc 2025-06-23 15:54:46 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2025:9396 https://access.redhat.com/errata/RHSA-2025:9396


Note You need to log in before you can comment on or make changes to this bug.