[ALSA-2026:92157] Critical: mod_auth_openidc:2.3 security update
Type:
security
Severity:
critical
Release date:
2026-10-29
Description:
The mod_auth_openidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Connect Relying Party and/or OAuth 2.0 Resource Server. Security Fix(es): * cjose: OpenIDC/cjose uses all-zero Content Encryption Key for AES-CBC-HMAC JWE encryption (CVE-2026-53939) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
References:
Updated packages listed below:
Architecture Package Checksum
aarch64 cjose-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm 049652da123d2f6376e2153aeaa6f265e2e9d539a2d7fce4defbe6c1ee206056
aarch64 mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.aarch64.rpm 4a9ad66e2b33de87388b82bfbeff6fe1a081a837f7247a45f4d401e0c4176897
aarch64 cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.aarch64.rpm 5e32fdf09a699760ba1b40ae3ef3e5e4ccf0c215cc6fbab514ad8d4d62a18e5d
ppc64le cjose-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm 94a39ffea423c154a72a55ade7810404048b862cac696b09015b9d29335c86bd
ppc64le cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.ppc64le.rpm b0df76905a943b5408352d918ae156bc2e5341f221f6f5f82088b00c1b8cce3f
ppc64le mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.ppc64le.rpm d8838defefdd3acc857c073654aa7d4b6ad369ae8bec62d2097e640a3500b6af
s390x mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.s390x.rpm a90e743b4a90366deb01710f5b8e6114ca82531a62358d135fbb07b48e570d0e
s390x cjose-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm c004c10900891b4faba1726f38638ada2599d03449b55c1e92d26007f916892f
s390x cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.s390x.rpm edc69e20cf4ef804d1ee038d288825bafec002c8559f8424f7536d0689e49d0c
x86_64 cjose-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm 21eea8f54bd22a4cca8e786f68a130047fc7e5bd21d41491c6de46dd71c69c09
x86_64 cjose-devel-0.6.1-6.module_el8.10.0+4330+15616d81.x86_64.rpm 84f93b7a1dc5b63ce8be97d9994b929e6b3c903e16262d8ad98140a0125421b4
x86_64 mod_auth_openidc-2.4.9.4-9.module_el8.10.0+4297+63ae3533.x86_64.rpm 8f4eb68e4f3f6575c178e13b26aa6a2471c6da2117468f4f95960a3101926214
Notes:
This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.