{
  "cveId": "CVE-2025-31492",
  "url": "https://patchblox.com/security/cve/CVE-2025-31492",
  "summary": "CVE-2025-31492 is fixed in 7 products on 1 platform, first by libapache2-mod-auth-openidc 2.4.11-1ubuntu0.1, released April 6, 2025. It is not reported as exploited. Patch Radar priority: High.",
  "title": "libapache2-mod-auth-openidc: mod_auth_openidc is an OpenID Certified authentication and authorizationmodule for the Apache 2.x HTTP server that im...",
  "description": "mod_auth_openidc is an OpenID Certified authentication and authorizationmodule for the Apache 2.x HTTP server that implements the OpenID ConnectRelying Party functionality. Prior to 2.4.16.11, a bug in amod_auth_openidc results in disclosure of protected content tounauthenticated users. The conditions for disclosure are anOIDCProviderAuthRequestMethod POST, a valid account, and there mustn\u0027t beany application-level gateway (or load balancer etc) protecting the server.When you request a protected resource, the response includes the HTTPstatus, the HTTP headers, the intended response (the self-submitting form),and the protected resource (with no headers). This is an example of arequest for a protected resource, including all the data returned. In thecase where mod_auth_openidc returns a form, it has to return OK fromcheck_userid so as not to go down the error path in httpd. This means httpdwill try to issue the protected resource. oidc_content_handler is calledearly, which has the opportunity to prevent the normal output being issuedby httpd. oidc_content_handler has a number of checks for when itintervenes, but it doesn\u0027t check for this case, so the handler returnsDECLINED. Consequently, httpd appends the protected content to theresponse. The issue has been patched in mod_auth_openidc versions \u003E=2.4.16.11.",
  "published": "2025-04-06T13:15:00Z",
  "severity": "Medium",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
  "epss": 0.00592,
  "epssPercentile": 0.48546,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "apache2-mod_auth_openidc",
      "release": "opensuse-leap 15.6",
      "fixedVersion": "2.4.17.1-150600.16.14.1",
      "fix": "SUSE-SU-2025:4532-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4532-1",
      "released": "2025-12-29T13:53:59Z"
    },
    {
      "platform": "linux",
      "product": "apache2-mod_auth_openidc",
      "release": "sles 15.6",
      "fixedVersion": "2.4.17.1-150600.16.14.1",
      "fix": "SUSE-SU-2025:4532-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4532-1",
      "released": "2025-12-29T13:53:59Z"
    },
    {
      "platform": "linux",
      "product": "apache2-mod_auth_openidc",
      "release": "sles 15.7",
      "fixedVersion": "2.4.17.1-150600.16.14.1",
      "fix": "SUSE-SU-2025:4532-1",
      "url": "https://patchblox.com/security/fix/linux/suse-su-2025-4532-1",
      "released": "2025-12-29T13:53:59Z"
    },
    {
      "platform": "linux",
      "product": "cjose",
      "release": "RHEL 8",
      "fixedVersion": "0:0.6.1-4.module\u002Bel8.10.0\u002B21813\u002Bb5444eb8",
      "fix": "RHSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2025-3997",
      "released": "2025-04-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "cjose",
      "release": "almalinux 8",
      "fixedVersion": "0.6.1-4.module_el8.9.0\u002B3631\u002B0ced13d7",
      "fix": "ALSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/alsa-2025-3997",
      "released": "2025-04-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "cjose",
      "release": "ol 8",
      "fixedVersion": "0:0.6.1-4.module\u002Bel8.10.0\u002B90549\u002B7b4eddfc",
      "fix": "ELSA-2025-3997",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-3997",
      "released": "2025-04-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "cjose",
      "release": "rocky 8",
      "fixedVersion": "0:0.6.1-4.module\u002Bel8.9.0\u002B1384\u002B4b58c166",
      "fix": "RLSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2025-3997",
      "released": "2025-07-29T13:38:41Z"
    },
    {
      "platform": "linux",
      "product": "cjose-devel",
      "release": "RHEL 8",
      "fixedVersion": "0:0.6.1-4.module\u002Bel8.10.0\u002B21813\u002Bb5444eb8",
      "fix": "RHSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2025-3997",
      "released": "2025-04-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "cjose-devel",
      "release": "almalinux 8",
      "fixedVersion": "0.6.1-4.module_el8.9.0\u002B3631\u002B0ced13d7",
      "fix": "ALSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/alsa-2025-3997",
      "released": "2025-04-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "cjose-devel",
      "release": "ol 8",
      "fixedVersion": "0:0.6.1-4.module\u002Bel8.10.0\u002B90549\u002B7b4eddfc",
      "fix": "ELSA-2025-3997",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-3997",
      "released": "2025-04-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "2.4.9.4-0\u002Bdeb11u5",
      "fix": "DLA-4129-1",
      "url": "https://patchblox.com/security/fix/linux/dla-4129-1",
      "released": "2025-04-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2.4.12.3-2\u002Bdeb12u3",
      "fix": "DSA-5904-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5904-1",
      "released": "2025-04-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2.4.16.11-1",
      "fix": "DEBIAN-CVE-2025-31492",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-31492",
      "released": "2025-04-06T20:15:15Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Debian 14",
      "fixedVersion": "2.4.16.11-1",
      "fix": "DEBIAN-CVE-2025-31492",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2025-31492",
      "released": "2025-04-06T20:15:15Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2.4.11-1ubuntu0.1",
      "fix": "libapache2-mod-auth-openidc 2.4.11-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-libapache2-mod-auth-openidc-2.4.11-1ubuntu0.1",
      "released": "2025-04-06T13:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "2.4.15.1-1ubuntu0.1",
      "fix": "libapache2-mod-auth-openidc 2.4.15.1-1ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-libapache2-mod-auth-openidc-2.4.15.1-1ubuntu0.1",
      "released": "2025-04-06T13:15:00Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "2.4.15.7-2ubuntu0.1",
      "fix": "libapache2-mod-auth-openidc 2.4.15.7-2ubuntu0.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-libapache2-mod-auth-openidc-2.4.15.7-2ubuntu0.1",
      "released": "2026-01-16T01:42:24Z"
    },
    {
      "platform": "linux",
      "product": "libapache2-mod-auth-openidc",
      "release": "Ubuntu 25.04 (plucky)",
      "fixedVersion": "2.4.16.10-1ubuntu1",
      "fix": "libapache2-mod-auth-openidc 2.4.16.10-1ubuntu1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-plucky-libapache2-mod-auth-openidc-2.4.16.10-1ubuntu1",
      "released": "2026-01-16T01:42:25Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "RHEL 10",
      "fixedVersion": "2.4.15-4.el10_0.1",
      "fix": "RHSA-2025:7490",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2025-7490",
      "released": "2025-04-06T20:02:20Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "RHEL 8",
      "fixedVersion": "0:2.4.9.4-7.module\u002Bel8.10.0\u002B23023\u002Bba6d7066",
      "fix": "RHSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2025-3997",
      "released": "2025-04-23T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "RHEL 9",
      "fixedVersion": "0:2.4.10-1.el9_6.1",
      "fix": "RHSA-2025:7419",
      "url": "https://patchblox.com/security/fix/linux/rhsa-2025-7419",
      "released": "2025-05-13T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "almalinux 10",
      "fixedVersion": "2.4.15-4.el10_0.1",
      "fix": "ALSA-2025:7490",
      "url": "https://patchblox.com/security/fix/linux/alsa-2025-7490",
      "released": "2025-05-13T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "almalinux 8",
      "fixedVersion": "2.4.9.4-7.module_el8.10.0\u002B3978\u002Be883c40d",
      "fix": "ALSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/alsa-2025-3997",
      "released": "2025-04-17T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "almalinux 9",
      "fixedVersion": "2.4.10-1.el9_6.1",
      "fix": "ALSA-2025:7419",
      "url": "https://patchblox.com/security/fix/linux/alsa-2025-7419",
      "released": "2025-05-13T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "amzn 2023",
      "fixedVersion": "2.4.16.11-1.amzn2023",
      "fix": "ALAS2023-2025-1188",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1188",
      "released": "2025-09-10T05:43:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "ol 10",
      "fixedVersion": "0:2.4.15-4.el10_0.1",
      "fix": "ELSA-2025-7490",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-7490",
      "released": "2025-06-27T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "ol 8",
      "fixedVersion": "0:2.4.9.4-7.module\u002Bel8.10.0\u002B90549\u002B7b4eddfc",
      "fix": "ELSA-2025-3997",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-3997",
      "released": "2025-04-22T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "ol 9",
      "fixedVersion": "0:2.4.10-1.el9_6.1",
      "fix": "ELSA-2025-7419",
      "url": "https://patchblox.com/security/fix/linux/elsa-2025-7419",
      "released": "2025-05-21T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "rocky 10",
      "fixedVersion": "0:2.4.15-4.el10_0.1",
      "fix": "RLSA-2025:7490",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2025-7490",
      "released": "2025-10-03T19:56:45Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "rocky 8",
      "fixedVersion": "0:2.4.9.4-7.module\u002Bel8.10.0\u002B1953\u002Bb76d6417",
      "fix": "RLSA-2025:3997",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2025-3997",
      "released": "2025-07-29T13:38:41Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc",
      "release": "rocky 9",
      "fixedVersion": "0:2.4.10-1.el9_6.1",
      "fix": "RLSA-2025:7419",
      "url": "https://patchblox.com/security/fix/linux/rlsa-2025-7419",
      "released": "2025-10-04T00:11:30Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc-debuginfo",
      "release": "amzn 2023",
      "fixedVersion": "2.4.16.11-1.amzn2023",
      "fix": "ALAS2023-2025-1188",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1188",
      "released": "2025-09-10T05:43:00Z"
    },
    {
      "platform": "linux",
      "product": "mod_auth_openidc-debugsource",
      "release": "amzn 2023",
      "fixedVersion": "2.4.16.11-1.amzn2023",
      "fix": "ALAS2023-2025-1188",
      "url": "https://patchblox.com/security/fix/linux/alas2023-2025-1188",
      "released": "2025-09-10T05:43:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T13:06:02Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}