CVE-2019-20479: Debian Linux

Medium severity, CVSS 6.1. EPSS: 1.9% chance of exploitation in the next 30 days.

A flaw was found in mod_auth_openidc before version 2.4.1. An open redirect issue exists in URLs with a slash and backslash at the beginning.

Affected products

• Debian Debian Linux: version 8.0 only; version 9.0 only
• Fedoraproject Fedora: version 31 only; version 32 only
• Openidc Mod Auth Openidc: before 2.4.1 (fixed in 2.4.1)
• Opensuse Leap: version 15.1 only

Published 2020-02-20. Last modified 2026-06-17.