CVE-2021-32791

Katalog CVE

CVSS 5.9 · Medium EPSS 1,5%

Kerentanan Reusing a Nonce, Key Pair in Encryption pada mod auth openidc, fedoraproject fedora. Skor CVSS 3.1 5.9 (Medium) menurut NVD.

Deskripsi (NVD)

mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines.

Rincian

Terbit di NVD

26 Juli 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

5.9 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-323: Reusing a Nonce, Key Pair in Encryption
CWE-330: Use of Insufficiently Random Values

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/zmartzone/mod_auth_openidc/commit/375407c16c61a70b56fdbe13b0d2c8f11398e92c patch · advisory pihak ketiga
• https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-px3c-6x7j-3r9r patch · advisory pihak ketiga
• https://www.oracle.com/security-alerts/cpuapr2022.html patch · advisory pihak ketiga
• https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9 release notes · advisory pihak ketiga
• https://lists.debian.org/debian-lts-announce/2023/04/msg00034.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FZVF6BSJLRQZ7...
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QXAWKPT5LXZSU...