CVE-2021-32791

Name of the Vulnerable Software and Affected Versions mod auth openidc versions prior to 2.4.9

Description The issue is related to the AES GCM encryption in mod auth openidc, which uses a static IV and AAD. This creates a static nonce and can lead to known cryptographic issues since the same key is being reused. The problem allows a remote attacker to access confidential data.

Recommendations For mod auth openidc versions prior to 2.4.9, update to version 2.4.9 or later, which uses dynamic values through the usage of cjose AES encryption routines to fix the issue. As a temporary workaround, consider restricting access to sensitive data until the update can be applied.