CVE-2021-32785 : What You Need to Know

Mod_auth_openidc is an authentication/authorization module for Apache 2.x HTTP server that operates as an OpenID Connect Relying Party. This CVE addresses a format string bug in the Redis cache implementation that affects versions prior to 2.4.9, potentially leading to a denial of service by crashing Apache workers.

Understanding CVE-2021-32785

This CVE addresses a critical vulnerability in mod_auth_openidc versions < 2.4.9 that could trigger a denial of service attack on Apache servers.

What is CVE-2021-32785?

When mod_auth_openidc is configured to use an unencrypted Redis cache, it mistakenly performs argument interpolation before passing Redis requests, resulting in an uncontrolled format string bug. This bug does not allow arbitrary code execution but can lead to repeated crashes of Apache workers.

The Impact of CVE-2021-32785

The vulnerability, if exploited, can provoke a denial of service by consistently crashing Apache workers due to the format string bug in the Redis cache implementation.

Technical Details of CVE-2021-32785

This section provides detailed technical insights into the vulnerability, affected systems, and exploitation mechanisms.

Vulnerability Description

The bug arises from argument interpolation in mod_auth_openidc before passing Redis requests, triggering an uncontrolled format string bug that can crash Apache workers.

Affected Systems and Versions

Vendor: zmartzone Product: mod_auth_openidc Versions Affected: < 2.4.9 Status: Affected

Exploitation Mechanism

The vulnerability can be exploited by configuring mod_auth_openidc to use an unencrypted Redis cache, leading to argument interpolation issues and subsequent crashes of Apache workers.

Mitigation and Prevention

Learn about the immediate steps to take and long-term security practices to enhance protection against CVE-2021-32785.

Immediate Steps to Take

Update to mod_auth_openidc version 2.4.9 to mitigate the vulnerability. As a workaround, enable

OIDCCacheEncrypt

to cryptographically hash cache keys.

Long-Term Security Practices

Regularly update mod_auth_openidc and other dependencies to secure your Apache servers against potential vulnerabilities.

Patching and Updates

Patch the vulnerability by upgrading to mod_auth_openidc version 2.4.9 or newer to prevent exploitation of the format string bug in the Redis cache implementation.