-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian Security Advisory DSA-5904-1                   security@debian.org
https://www.debian.org/security/                       Moritz Muehlenhoff
April 17, 2025                        https://www.debian.org/security/faq
- -------------------------------------------------------------------------

Package        : libapache2-mod-auth-openidc
CVE ID         : CVE-2025-31492

It was discovered that mod_auth_openidc, an OpenID Certified
authentication and authorization module for the Apache HTTP server that
implements the OpenID Connect Relying Party functionality, was
susceptible to information disclosure in some configurations

For the stable distribution (bookworm), this problem has been fixed in
version 2.4.12.3-2+deb12u3.

We recommend that you upgrade your libapache2-mod-auth-openidc packages.

For the detailed security status of libapache2-mod-auth-openidc please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/libapache2-mod-auth-openidc

Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/

Mailing list: debian-security-announce@lists.debian.org
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEtuYvPRKsOElcDakFEMKTtsN8TjYFAmgBVfwACgkQEMKTtsN8
TjZVaA/+JoWMDYtZYN//NRAYJiVRVgxEZdOK8+NNnq02QPCBRJoIkd11UeTvtfq3
FPILwHNIExAhKieCaOCqsC9ag06B8Q7zIvmc1ffAJtdKLt8XiF+I12APf/Hz7Poe
sB5kKpX3BEvhlY2Wu/Fp/DEyT2F/S9DAoIhAJZ9QjJ82duScisPJX+x4eDdv2JtY
ZNBEaZL7jyHdLWP+hrSv1+fzxpDg4T4wdyCpqHnD01OaNdIYBuWpVReaVJK1HpUl
hV0lTM3cse7hy7uvPrLIL2Ut+En7m8mMbyuQGnlmZSlb53JOFewIxH8TZt34u7wl
SBxxBX2QPTV++TYeBrg3c1kmKdSSypmKFY/krdA5iEvvan34wVckczQpp6VIUz9m
NEmc8Z5NtFX3BtV4Hnr2jOLw7t878l72mekx0tZNiuqUZMlCwCC3m4cFnHiIPa0U
PQtimpjcZ1CKyiVbnbZN4p6I+g04qisxxtPYbWfcyso4eXZUBmKka7/bMYHo2eFm
BGtJ2H1+jPAjGh6lok9AY0sJXcarQ9pWDI7pDoWHFC0XB5CUtcu3LCp/1x6vPo+l
bDEvEftTeNkQ7dEHtwQpcj5MapMXHldDlZA9/my6TNF0MddvhJ0r4VN3pBakae89
RmXyD20MMMQc19NEueB9gEjPhKNxOsfU9UqGUV+yrsTSG3xDkfw=
=/ggv
-----END PGP SIGNATURE-----