CVE-2021-32785

A flaw was found in mod_auth_openidc. When mod_auth_openidc is configured to use unencrypted Redis cache it is possible to trigger a format string bug that could be used by a remote unauthenticated attacker to crash the httpd workers. The highest threat from this liability is to service availability.

This issue did not affect the versions of mod_auth_openidc as shipped with Red Hat Enterprise Linux 7, and 8 as they did not include support for Redis cache.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.