[ol8_appstream] mod_auth_openidc-2.4.9.4-7.module+el8.10.0+90549+7b4eddfc.x86_64

Name:	mod_auth_openidc
Version:	2.4.9.4
Release:	7.module+el8.10.0+90549+7b4eddfc
Architecture:	x86_64
Module:	mod_auth_openidc:2.3:8100020250422022000:e155f54d
Group:	Unspecified
Size:	589420
License:	ASL 2.0
RPM:	mod_auth_openidc-2.4.9.4-7.module+el8.10.0+90549+7b4eddfc.x86_64.rpm
Source RPM:	mod_auth_openidc-2.4.9.4-7.module+el8.10.0+90549+7b4eddfc.src.rpm
Build Date:	Tue Apr 22 2025
Build Host:	build-ol8-x86_64.oracle.com
Vendor:	Oracle America
URL:	https://github.com/zmartzone/mod_auth_openidc
Summary:	OpenID Connect auth module for Apache HTTP Server
Description:	This module enables an Apache 2.x web server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server.

Changelog (Show File list) (Show related packages)

Fri Apr 11 2025 Tomas Halman <thalman@redhat.com> - 2.4.9.4-7

- Resolves: RHEL-86218 - mod_auth_openidc allows OIDCProviderAuthRequestMethod
            POSTs to leak protected data (CVE-2025-31492)

Fri Apr 12 2024 Tomas Halman <thalman@redhat.com> - 2.4.9.4-6

- Resolves: RHEL-36492 Race condition in mod_auth_openidc filecache
- Resolves: RHEL-25421 mod_auth_openidc: DoS when using
    `OIDCSessionType client-cookie` and manipulating cookies
    (CVE-2024-24814)

Tue Apr 25 2023 Tomas Halman <thalman@redhat.com> - 2.4.9.4-5
```
Related: rhbz#2141850 - fix cjose version dependency
```

Mon Apr 24 2023 Tomas Halman <thalman@redhat.com> - 2.4.9.4-4

Resolves: rhbz#2141850 - auth_openidc.conf mode 0640 by default

Tue Apr 11 2023 Tomas Halman <thalman@redhat.com> - 2.4.9.4-3

- Resolves: rhbz#2184144 - CVE-2023-28625 NULL pointer dereference
      when OIDCStripCookies is set and a crafted Cookie header is supplied

Tue Feb 21 2023 Tomas Halman <thalman@redhat.com> - 2.4.9.4-2

- Resolves: rhbz#2153659 - CVE-2022-23527 - Open Redirect in
      oidc_validate_redirect_url() using tab character

Fri Apr 08 2022 Tomas Halman <thalman@redhat.com> - 2.4.9.4-1
```
- Resolves: rhbz#2025368 - Rebase to new version
```

Fri Jan 28 2022 Tomas Halman <thalman@redhat.com> - 2.3.7-11

- Resolves: rhbz#1987222 - CVE-2021-32792 XSS when using OIDCPreservePost On

Fri Jan 28 2022 Tomas Halman <thalman@redhat.com> - 2.3.7-10

- Resolves: rhbz#1987216 - CVE-2021-32791 hardcoded static IV and AAD with a
                           reused key in AES GCM encryption [rhel-8] (edit)

Fri Oct 29 2021 Tomas Halman <thalman@redhat.com> - 2.3.7-9

- Resolves: rhbz#2001853 - CVE-2021-39191 open redirect by supplying a crafted URL
                           in the target_link_uri parameter