CVE-2021-20718: 
CBL Mariner vulnerability analysis and mitigation

mod_auth_openidc versions 2.4.0 to 2.4.7 contains a vulnerability that allows a remote attacker to cause a denial-of-service (DoS) condition via unspecified vectors. The vulnerability was assigned CVE-2021-20718 and was discovered in December 2020, with public disclosure in May 2021 (JVN Report).

The vulnerability has been assigned a CVSS v3.1 Base Score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified as CWE-400 (Uncontrolled Resource Consumption). The attack vector is network-accessible, requires low attack complexity, needs no privileges or user interaction, and primarily impacts system availability (NVD).

A successful exploitation of this vulnerability can result in a denial-of-service condition, affecting the availability of the system. The vulnerability has no impact on confidentiality or integrity of the system (JVN Report).

The vulnerability can be exploited remotely by an unauthenticated attacker with no user interaction required. The attack complexity is considered low, making it relatively straightforward to exploit (NVD).

The recommended mitigation is to update to mod_auth_openidc version 2.4.8 or later. Multiple distributions have released security updates to address this vulnerability, including Fedora and Oracle (Fedora Update, Oracle Alert).