release 2.4.8.1

Security

• fix potential crash when the Content-Type header is not set in POST requests; thanks Tatsuhiko Yasumatsu of JPCERT/CC (CVE-2021-20718 and JVN#49704918)

Bugfixes

• avoid jwt/proto_state json_object memory leaks on cache failures
• when an OAuth 2.0 RS token scope/claim authorization (401 ) error occurs, add a OIDC_OAUTH_BEARER_SCOPE_ERROR environment variable for usage with mod_headers, instead of adding a header ourselves; see #572; usage, e.g;

  Header always append WWW-Authenticate %{OIDC_OAUTH_BEARER_SCOPE_ERROR}e "expr=(%{REQUEST_STATUS} == 401) && (-n reqenv('OIDC_OAUTH_BEARER_SCOPE_ERROR'))"
  

  Note: if you're using mod_auth_openidc in OAuth 2.0 RS mode and your clients rely on the WWW-Authenticate header the above is a breaking change, and you'll need to explicitly set that header now.

Features

• add options to configure Redis connectivity timeouts with OIDCRedisCacheConnectTimeout and OIDCRedisCacheTimeout
• add OIDCClientTokenEndpointKeyPassword option to set a private key password for the client's private key to be used against the token endpoint; see #576

Dependencies

• libcjose >= 0.5.1

Other

• binary packages for various other platforms such as Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7 Power PC (ppc64, ppc64le), Oracle Linux 6/7, older Ubuntu and Debian distro's, Oracle HTTP Server 11.1/12.2, IBM HTTP Server 8/9, Mac OS X and Microsoft Windows 64bit/32bit are available under a commercial agreement via [email protected]
• support for Redis (TLS) Cluster and Redis over TLS is available under a commercial license via [email protected]