libapache2-mod-auth-openidc: mod_auth_openidc is an OpenID Certified authentication and authorizationmodule for the Apache 2.x HTTP server that im...

mod_auth_openidc is an OpenID Certified authentication and authorizationmodule for the Apache 2.x HTTP server that implements the OpenID ConnectRelying Party functionality. Prior to 2.4.16.11, a bug in amod_auth_openidc results in disclosure of protected content tounauthenticated users. The conditions for disclosure are anOIDCProviderAuthRequestMethod POST, a valid account, and there mustn't beany application-level gateway (or load balancer etc) protecting the server.When you request a protected resource, the response includes the HTTPstatus, the HTTP headers, the intended response (the self-submitting form),and the protected resource (with no headers). This is an example of arequest for a protected resource, including all the data returned. In thecase where mod_auth_openidc returns a form, it has to return OK fromcheck_userid so as not to go down the error path in httpd. This means httpdwill try to issue the protected resource. oidc_content_handler is calledearly, which has the opportunity to prevent the normal output being issuedby httpd. oidc_content_handler has a number of checks for when itintervenes, but it doesn't check for this case, so the handler returnsDECLINED. Consequently, httpd appends the protected content to theresponse. The issue has been patched in mod_auth_openidc versions >=2.4.16.11.

Where it's fixed