CVE-2021-32791 SUSE CVE security@suse.de SUSE Security Team SUSE CVE-2021-32791 Interim 1 28 2026-03-05T05:18:48Z current 2021-07-29T00:57:12Z 2026-03-05T05:18:48Z cve-database/bin/generate-cvrf-cve.pl 2020-12-27T01:00:00Z CVE-2021-32791 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines. The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). https://lists.suse.com/pipermail/sle-security-updates/2021-September/009431.html E-Mail link for SUSE-SU-2021:3020-1 https://lists.suse.com/pipermail/sle-security-updates/2021-October/009576.html E-Mail link for SUSE-SU-2021:3352-1 https://lists.suse.com/pipermail/sle-security-updates/2025-December/023659.html E-Mail link for SUSE-SU-2025:4532-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/4FGDDGUNYC724M4QGEPJORKASFRVKJ5V/ E-Mail link for openSUSE-SU-2021:1277-1 https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/54B4RYNP5L63X2FMX2QCVYB2LGLL42IY/ E-Mail link for openSUSE-SU-2021:3020-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings SUSE CaaS Platform 4.0 SUSE Enterprise Storage 6 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Liberty Linux 8 SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server 12 SP4-ESPOS SUSE Linux Enterprise Server 12 SP4-LTSS SUSE Linux Enterprise Server 12 SP5 SUSE Linux Enterprise Server 15 SP1-LTSS SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Server for SAP Applications 12 SP4 SUSE Linux Enterprise Server for SAP Applications 12 SP5 SUSE Linux Enterprise Server for SAP Applications 15 SP1 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP5 SUSE Linux Enterprise Module for Server Applications 15 SP6 SUSE Linux Enterprise Module for Server Applications 15 SP7 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE Linux Enterprise Module for Server Applications 15 SP2 SUSE Linux Enterprise Module for Server Applications 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP4 SUSE OpenStack Cloud 9 SUSE OpenStack Cloud Crowbar 9 openSUSE Leap 15.2 openSUSE Leap 15.3 openSUSE Leap 15.6 apache2-mod_auth_openidc apache2-mod_auth_openidc-2.3.8-3.15.1 apache2-mod_auth_openidc-2.3.8-lp152.5.6.1 apache2-mod_auth_openidc-2.4.0-3.23.1 apache2-mod_auth_openidc-2.4.17.1-150600.16.14.1 cjose-0.6.1-2.module+el8+2454+f890a43a cjose-devel-0.6.1-2.module+el8+2454+f890a43a mod_auth_openidc-2.3.7-11.module+el8.6.0+14082+b6f23e95 cjose-0.6.1-2.module+el8+2454+f890a43a as a component of SUSE Liberty Linux 8 cjose-devel-0.6.1-2.module+el8+2454+f890a43a as a component of SUSE Liberty Linux 8 mod_auth_openidc-2.3.7-11.module+el8.6.0+14082+b6f23e95 as a component of SUSE Liberty Linux 8 apache2-mod_auth_openidc-2.3.8-3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP2 apache2-mod_auth_openidc-2.3.8-3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 apache2-mod_auth_openidc-2.3.8-3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP4 apache2-mod_auth_openidc-2.3.8-3.15.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP5 apache2-mod_auth_openidc-2.4.17.1-150600.16.14.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP6 apache2-mod_auth_openidc-2.4.17.1-150600.16.14.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP7 apache2-mod_auth_openidc-2.4.0-3.23.1 as a component of SUSE Linux Enterprise Server 12 SP5 apache2-mod_auth_openidc-2.4.0-3.23.1 as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-mod_auth_openidc-2.3.8-lp152.5.6.1 as a component of openSUSE Leap 15.2 apache2-mod_auth_openidc-2.3.8-3.15.1 as a component of openSUSE Leap 15.3 apache2-mod_auth_openidc-2.4.17.1-150600.16.14.1 as a component of openSUSE Leap 15.6 apache2-mod_auth_openidc as a component of SUSE CaaS Platform 4.0 apache2-mod_auth_openidc as a component of SUSE Enterprise Storage 6 apache2-mod_auth_openidc as a component of SUSE Linux Enterprise High Performance Computing 15 SP1-LTSS apache2-mod_auth_openidc as a component of SUSE Linux Enterprise Server 12 SP4-ESPOS apache2-mod_auth_openidc as a component of SUSE Linux Enterprise Server 12 SP4-LTSS apache2-mod_auth_openidc as a component of SUSE Linux Enterprise Server 15 SP1-LTSS apache2-mod_auth_openidc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP4 apache2-mod_auth_openidc as a component of SUSE Linux Enterprise Server for SAP Applications 12 SP5 apache2-mod_auth_openidc as a component of SUSE Linux Enterprise Server for SAP Applications 15 SP1 apache2-mod_auth_openidc as a component of SUSE OpenStack Cloud 9 apache2-mod_auth_openidc as a component of SUSE OpenStack Cloud Crowbar 9 mod_auth_openidc is an authentication/authorization module for the Apache 2.x HTTP server that functions as an OpenID Connect Relying Party, authenticating users against an OpenID Connect Provider. In mod_auth_openidc before version 2.4.9, the AES GCM encryption in mod_auth_openidc uses a static IV and AAD. It is important to fix because this creates a static nonce and since aes-gcm is a stream cipher, this can lead to known cryptographic issues, since the same key is being reused. From 2.4.9 onwards this has been patched to use dynamic values through usage of cjose AES encryption routines. CVE-2021-32791 SUSE Liberty Linux 8:cjose-0.6.1-2.module+el8+2454+f890a43a SUSE Liberty Linux 8:cjose-devel-0.6.1-2.module+el8+2454+f890a43a SUSE Liberty Linux 8:mod_auth_openidc-2.3.7-11.module+el8.6.0+14082+b6f23e95 SUSE Linux Enterprise Module for Server Applications 15 SP2:apache2-mod_auth_openidc-2.3.8-3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-mod_auth_openidc-2.3.8-3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP4:apache2-mod_auth_openidc-2.3.8-3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP5:apache2-mod_auth_openidc-2.3.8-3.15.1 SUSE Linux Enterprise Module for Server Applications 15 SP6:apache2-mod_auth_openidc-2.4.17.1-150600.16.14.1 SUSE Linux Enterprise Module for Server Applications 15 SP7:apache2-mod_auth_openidc-2.4.17.1-150600.16.14.1 SUSE Linux Enterprise Server 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 SUSE Linux Enterprise Server for SAP Applications 12 SP5:apache2-mod_auth_openidc-2.4.0-3.23.1 openSUSE Leap 15.2:apache2-mod_auth_openidc-2.3.8-lp152.5.6.1 openSUSE Leap 15.3:apache2-mod_auth_openidc-2.3.8-3.15.1 openSUSE Leap 15.6:apache2-mod_auth_openidc-2.4.17.1-150600.16.14.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N