CVE-2021-20718: mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors

High severity · published May 20, 2021

CVE-2021-20718

mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors

7.5

CVSS

3.4%

EPSS

On KEV

Description

mod_auth_openidc 2.4.0 to 2.4.7 allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)3.4% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Essbase · Oracle

before 21.3 · source: NVD

Fedora · Fedoraproject

33; 34 · source: NVD

Mod Auth Openidc · Openidc

2.4.0 through 2.4.7 · source: NVD

Affected product

Fedora

Fedoraproject

All Fedora CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-20718

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-20718

Product

https://github.com/zmartzone/mod_auth_openidc

Third Party Advisory

https://jvn.jp/en/jp/JVN49704918/index.html

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/5HJK366TLFEOIYWTHQSZO24MSDPBXHJU/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FV4KYMQWPS3I2QPW2C253MLIAFGBZPLK/

Third Party Advisory

https://www.oracle.com/security-alerts/cpujan2022.html

Vendor Advisory

https://www.zmartzone.eu/