[{"CVE":"CVE-2019-20479","severity":"moderate","public_date":"2019-11-12T00:00:00Z","advisories":["RHSA-2020:3970","RHSA-2020:3032"],"bugzilla":"1805102","bugzilla_description":"CVE-2019-20479 mod_auth_openidc: Open redirect issue exists in URLs with slash and backslash","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-601","affected_packages":["mod_auth_openidc-0:1.8.8-7.el7","mod_auth_openidc:2.3-8020020200604180605.4cda2c84"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-20479.json","cvss3_scoring_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss3_score":"6.1"},{"CVE":"CVE-2019-14857","severity":"moderate","public_date":"2019-10-02T00:00:00Z","advisories":["RHSA-2020:3970","RHSA-2020:3032"],"bugzilla":"1760613","bugzilla_description":"CVE-2019-14857 mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-601","affected_packages":["mod_auth_openidc-0:1.8.8-7.el7","mod_auth_openidc:2.3-8020020200604180605.4cda2c84"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2019-14857.json","cvss3_scoring_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvss3_score":"6.1"},{"CVE":"CVE-2017-6413","severity":"moderate","public_date":"2017-02-20T00:00:00Z","advisories":["RHSA-2019:2112"],"bugzilla":"1428855","bugzilla_description":"CVE-2017-6413 mod_auth_openidc: OIDC_CLAIM and OIDCAuthNHeader not skipped in an \"AuthType oauth20\" configuration","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-287","affected_packages":["mod_auth_openidc-0:1.8.8-5.el7"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-6413.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cvss3_score":"5.9"},{"CVE":"CVE-2017-6062","severity":"moderate","public_date":"2017-01-30T00:00:00Z","advisories":[],"bugzilla":"1425353","bugzilla_description":"CVE-2017-6062 mod_auth_openidc: OIDCUnAuthAction pass does not scrub request headers","cvss_score":null,"cvss_scoring_vector":null,"CWE":"CWE-290","affected_packages":[],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-6062.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N","cvss3_score":"6.5"},{"CVE":"CVE-2017-6059","severity":"low","public_date":"2017-01-18T00:00:00Z","advisories":["RHSA-2019:2112"],"bugzilla":"1425350","bugzilla_description":"CVE-2017-6059 mod_auth_openidc: Shows user-supplied content on error pages","cvss_score":null,"cvss_scoring_vector":null,"CWE":null,"affected_packages":["mod_auth_openidc-0:1.8.8-5.el7"],"resource_url":"https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2017-6059.json","cvss3_scoring_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss3_score":"5.3"}]