Security readout for executives and security teams
Plain-English summary
This issue can make Apache authentication workers crash when a specific Redis-backed mod_auth_openidc configuration is exposed. It is not described as a data theft or code execution issue. Business impact is service disruption for protected web applications until the module is upgraded or the cache is encrypted.
Executive priority
Treat as a targeted availability risk, not a broad compromise scenario. Remediate promptly on externally reachable authentication front ends, especially where outages affect customer access or internal single sign-on availability.
Technical view
A CWE-134 format string flaw occurred because mod_auth_openidc interpolated Redis request arguments before hiredis interpolated them again. Under the affected Redis cache configuration, attacker-controlled input could trigger worker crashes. The advisory says arbitrary code execution did not appear likely, but denial of service was reliable.
Likely exposure
Exposure is narrow: Apache deployments using mod_auth_openidc before 2.4.9 with Redis server-side cache and OIDCCacheEncrypt off. Sites using encrypted cache keys or other cache/session configurations are not described as affected in the provided sources.
Exploitation context
The CVE is not listed as KEV, and the provided sources do not claim active exploitation. The public advisory describes reliable denial of service through repeated Apache worker crashes, but does not support claims of arbitrary code execution.
Researcher notes
The vulnerable condition depends on a specific Redis cache configuration and unencrypted cache keys. The fix changes Redis request handling to use the hiredis API with one interpolation pass. Evidence for impact beyond denial of service is not present in the supplied sources.
Mitigation direction
- Upgrade mod_auth_openidc to version 2.4.9 or later.
- Set OIDCCacheEncrypt to on where Redis cache remains in use.
- Check distribution or vendor advisories for packaged backports.
- Prioritize internet-facing authentication gateways and high-availability portals.
Validation and detection
- Inventory Apache hosts running mod_auth_openidc.
- Confirm installed mod_auth_openidc versions are 2.4.9 or patched builds.
- Review configuration for OIDCSessionType server-cache and OIDCCacheType redis.
- Verify OIDCCacheEncrypt is not set to off on affected versions.
- Check Apache error logs for repeated worker crashes around authentication traffic.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-134: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-32785 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L3.91.4Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
5.3MediumVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/zmartzone/mod_auth_openidc/security/advisories/GHSA-55r8-6w97-xxr4CVE reference
- https://github.com/zmartzone/mod_auth_openidc/commit/dc672688dc1f2db7df8ad4abebc367116017a449CVE reference
- https://github.com/zmartzone/mod_auth_openidc/releases/tag/v2.4.9CVE reference
- https://www.oracle.com/security-alerts/cpuapr2022.htmlCVE reference
- https://security.netapp.com/advisory/ntap-20210902-0001/CVE reference
- [debian-lts-announce] 20230430 [SECURITY] [DLA 3409-1] libapache2-mod-auth-openidc security updateCVE reference · mailing-list
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Externally-Controlled Format String
Use of Externally-Controlled Format String represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.