libapache2-mod-auth-openidc - Debian Package Tracker

general

source: libapache2-mod-auth-openidc (main)
version: 2.4.19.4-1
maintainer: Moritz Schlarb (DMD)
uploaders: Christoph Martin [DMD]
arch: any
std-ver: 4.7.4
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 2.4.9.4-0+deb11u4
o-o-sec: 2.4.9.4-0+deb11u6
oldstable: 2.4.12.3-2+deb12u4
old-sec: 2.4.12.3-2+deb12u4
stable: 2.4.17-1
testing: 2.4.19.4-1
unstable: 2.4.19.4-1

versioned links

2.4.9.4-0+deb11u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.9.4-0+deb11u6: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.12.3-2+deb12u4: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.17-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.4.19.4-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

libapache2-mod-auth-openidc

action needed

A new upstream version is available: 2.4.20.2 high

A new upstream version 2.4.20.2 is available, you should consider packaging it.

Created: 2026-08-04 Last update: 2026-08-24 03:03

1 security issue in trixie high

There is 1 open security issue in trixie.

1 important issue:

CVE-2026-54789: mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

Created: 2026-08-22 Last update: 2026-08-22 04:50

1 security issue in bullseye high

There is 1 open security issue in bullseye.

1 important issue:

CVE-2026-54789: mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

Created: 2026-08-22 Last update: 2026-08-22 04:50

1 security issue in bookworm high

There is 1 open security issue in bookworm.

1 important issue:

CVE-2026-54789: mod_auth_openidc is an OpenID Certified authentication and authorization module for the Apache 2.x HTTP server that implements the OpenID Connect Relying Party functionality. Prior to 2.4.19.4, an out-of-bounds read and a one-byte out-of-bounds write exist in the state-cookie parser of `mod_auth_openidc`. The issue is fixed in version 2.4.19.4 by stopping the scan at the string terminator so a value-less token is rejected. No in-product workarounds are available. As a stop-gap, an upstream reverse proxy or WAF that rejects or normalizes malformed `Cookie` headers (tokens lacking `=`) can reduce exposure, but upgrading is the recommended remediation.

Created: 2026-08-22 Last update: 2026-08-22 04:50

1 new commit since last upload, is it time to release? normal

vcswatch reports that this package seems to have new commits in its VCS but has not yet updated debian/changelog. You should consider updating the Debian changelog and uploading this new version into the archive.

Here are the relevant commit logs:

commit 8d7f00f6c74640c9c9b096bee73f69e8b295c11a
Author: Alexandre Detiste <alexandre.detiste@gmail.com>
Date:   Sun Jul 12 13:43:05 2026 +0200

    fix dh_cruft glitch

https://salsa.debian.org/api/v4/projects/debian%2Flibapache2-mod-auth-openidc API request failed: 401 Unauthorized at /srv/qa.debian.org/data/vcswatch/vcswatch line 410.

Created: 2026-07-12 Last update: 2026-08-20 09:02

lintian reports 3 warnings normal

Lintian reports 3 warnings about this package. You should make the package lintian clean getting rid of them.

Created: 2026-07-06 Last update: 2026-07-06 22:47

testing migrations

This package will soon be part of the auto-openssl transition. You might want to ensure that your package is ready for it. You can probably find supplementary information in the debian-release archives or in the corresponding release.debian.org bug.

news

[rss feed]

[2026-07-08] libapache2-mod-auth-openidc 2.4.19.4-1 MIGRATED to testing (Debian testing watch)
[2026-07-06] Accepted libapache2-mod-auth-openidc 2.4.19.4-1 (source) into unstable (Moritz Schlarb)
[2026-07-06] Accepted libapache2-mod-auth-openidc 2.4.19.2-3 (source) into unstable (Moritz Schlarb)
[2026-07-06] Accepted libapache2-mod-auth-openidc 2.4.19.2-2 (source) into unstable (Moritz Schlarb)
[2026-03-16] libapache2-mod-auth-openidc 2.4.19.2-1 MIGRATED to testing (Debian testing watch)
[2026-03-13] Accepted libapache2-mod-auth-openidc 2.4.19.2-1 (source) into unstable (Moritz Schlarb)
[2026-02-20] libapache2-mod-auth-openidc 2.4.19.1-2 MIGRATED to testing (Debian testing watch)
[2026-02-12] Accepted libapache2-mod-auth-openidc 2.4.19.1-2 (source) into unstable (Moritz Schlarb)
[2026-02-12] Accepted libapache2-mod-auth-openidc 2.4.19.1-1 (source) into unstable (Moritz Schlarb)
[2026-01-02] Accepted libapache2-mod-auth-openidc 2.4.19-1 (source) into unstable (Moritz Schlarb)
[2025-10-08] libapache2-mod-auth-openidc 2.4.18.1-1 MIGRATED to testing (Debian testing watch)
[2025-10-06] Accepted libapache2-mod-auth-openidc 2.4.18.1-1 (source) into unstable (Moritz Schlarb)
[2025-08-25] libapache2-mod-auth-openidc 2.4.18-1 MIGRATED to testing (Debian testing watch)
[2025-08-22] Accepted libapache2-mod-auth-openidc 2.4.18-1 (source) into unstable (Moritz Schlarb)
[2025-08-17] libapache2-mod-auth-openidc 2.4.17.2-1 MIGRATED to testing (Debian testing watch)
[2025-08-12] Accepted libapache2-mod-auth-openidc 2.4.17.2-1 (source) into unstable (Moritz Schlarb)
[2025-05-09] Accepted libapache2-mod-auth-openidc 2.4.12.3-2+deb12u4 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Schlarb)
[2025-05-08] Accepted libapache2-mod-auth-openidc 2.4.12.3-2+deb12u4 (source) into stable-security (Debian FTP Masters) (signed by: Moritz Schlarb)
[2025-05-08] Accepted libapache2-mod-auth-openidc 2.4.9.4-0+deb11u6 (source) into oldstable-security (Moritz Schlarb)
[2025-05-02] libapache2-mod-auth-openidc 2.4.17-1 MIGRATED to testing (Debian testing watch)
[2025-04-22] Accepted libapache2-mod-auth-openidc 2.4.17-1 (source) into unstable (Moritz Schlarb)
[2025-04-18] Accepted libapache2-mod-auth-openidc 2.4.12.3-2+deb12u3 (source) into proposed-updates (Debian FTP Masters) (signed by: Moritz Schlarb)
[2025-04-17] Accepted libapache2-mod-auth-openidc 2.4.12.3-2+deb12u3 (source) into stable-security (Debian FTP Masters) (signed by: Moritz Schlarb)
[2025-04-17] Accepted libapache2-mod-auth-openidc 2.4.9.4-0+deb11u5 (source) into oldstable-security (Moritz Schlarb)
[2025-04-12] libapache2-mod-auth-openidc 2.4.16.11-1 MIGRATED to testing (Debian testing watch)
[2025-04-10] Accepted libapache2-mod-auth-openidc 2.4.16.11-1 (source) into unstable (Moritz Schlarb)
[2025-03-23] libapache2-mod-auth-openidc 2.4.16.10-1 MIGRATED to testing (Debian testing watch)
[2025-03-22] libapache2-mod-auth-openidc 2.4.16.9-1 MIGRATED to testing (Debian testing watch)
[2025-03-21] Accepted libapache2-mod-auth-openidc 2.4.16.10-1 (source) into unstable (Moritz Schlarb)
[2025-03-19] Accepted libapache2-mod-auth-openidc 2.4.16.9-1 (source) into unstable (Moritz Schlarb)

bugs [bug history graph]

all: 0

links

homepage
lintian (0, 3)
buildd: logs, reproducibility, cross
popcon
browse source code
other distros
security tracker
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 2.4.19.4-1build1