Search
Find a vulnerability
Search criteria
16 vulnerabilities found for mod_auth_mellon by uninett
CVE-2021-3639 (GCVE-0-2021-3639)
Vulnerability from nvd – Published: 2022-08-22 14:49 – Updated: 2024-08-03 17:01
VLAI
EPSS
VEX
Summary
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
Severity
No CVSS data available.
CWE
- CWE-601 - - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1980648 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2021-3639 | x_refsource_MISC |
| https://github.com/latchset/mod_auth_mellon/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | mod_auth_mellon |
Affected:
Fixed in v0.18.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:07.702Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980648"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2021-3639"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/latchset/mod_auth_mellon/commit/42a11261b9dad2e48d70bdff7c53dd57a12db6f5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mod_auth_mellon",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixed in v0.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 - URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-22T14:49:03.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980648"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://access.redhat.com/security/cve/CVE-2021-3639"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/latchset/mod_auth_mellon/commit/42a11261b9dad2e48d70bdff7c53dd57a12db6f5"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-3639",
"datePublished": "2022-08-22T14:49:03.000Z",
"dateReserved": "2021-07-09T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:01:07.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-3877 (GCVE-0-2019-3877)
Vulnerability from nvd – Published: 2019-03-27 12:19 – Updated: 2024-08-04 19:19
VLAI
EPSS
VEX
Summary
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Severity
5.8 (Medium)
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_CONFIRM |
| https://github.com/Uninett/mod_auth_mellon/issues/35 | x_refsource_CONFIRM |
| https://github.com/Uninett/mod_auth_mellon/commit… | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3924-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://access.redhat.com/errata/RHSA-2019:0766 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:3421 | vendor-advisoryx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| uninett | mod_auth_mellon |
Affected:
v0.14.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:19:18.685Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Uninett/mod_auth_mellon/issues/35"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:3421",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3421"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mod_auth_mellon",
"vendor": "uninett",
"versions": [
{
"status": "affected",
"version": "v0.14.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-06T00:06:36.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Uninett/mod_auth_mellon/issues/35"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:3421",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3421"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2019-3877",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "mod_auth_mellon",
"version": {
"version_data": [
{
"version_value": "v0.14.2"
}
]
}
}
]
},
"vendor_name": "uninett"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-601"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877"
},
{
"name": "https://github.com/Uninett/mod_auth_mellon/issues/35",
"refsource": "CONFIRM",
"url": "https://github.com/Uninett/mod_auth_mellon/issues/35"
},
{
"name": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8",
"refsource": "CONFIRM",
"url": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8"
},
{
"name": "USN-3924-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0766",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:3421",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3421"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2019-3877",
"datePublished": "2019-03-27T12:19:19.000Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-08-04T19:19:18.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-3878 (GCVE-0-2019-3878)
Vulnerability from nvd – Published: 2019-03-26 17:44 – Updated: 2024-08-04 19:19
VLAI
EPSS
VEX
Summary
A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
Severity
8.1 (High)
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_CONFIRM |
| https://github.com/Uninett/mod_auth_mellon/pull/196 | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3924-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://access.redhat.com/errata/RHSA-2019:0746 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:0766 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:0985 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHBA-2019:0959 | vendor-advisoryx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| uninett | mod_auth_mellon |
Affected:
before v0.14.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:19:18.665Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Uninett/mod_auth_mellon/pull/196"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0746",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0746"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:0985",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0985"
},
{
"name": "RHBA-2019:0959",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHBA-2019:0959"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mod_auth_mellon",
"vendor": "uninett",
"versions": [
{
"status": "affected",
"version": "before v0.14.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-07T08:06:03.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Uninett/mod_auth_mellon/pull/196"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0746",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0746"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:0985",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0985"
},
{
"name": "RHBA-2019:0959",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHBA-2019:0959"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2019-3878",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "mod_auth_mellon",
"version": {
"version_data": [
{
"version_value": "before v0.14.2"
}
]
}
}
]
},
"vendor_name": "uninett"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "8.1/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878"
},
{
"name": "https://github.com/Uninett/mod_auth_mellon/pull/196",
"refsource": "CONFIRM",
"url": "https://github.com/Uninett/mod_auth_mellon/pull/196"
},
{
"name": "USN-3924-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0746",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0746"
},
{
"name": "RHSA-2019:0766",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:0985",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0985"
},
{
"name": "RHBA-2019:0959",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHBA-2019:0959"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2019-3878",
"datePublished": "2019-03-26T17:44:29.000Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-08-04T19:19:18.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-6807 (GCVE-0-2017-6807)
Vulnerability from nvd – Published: 2017-03-13 14:00 – Updated: 2024-08-05 15:41
VLAI
EPSS
VEX
Summary
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/UNINETT/mod_auth_mellon/releas… | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/96843 | vdb-entryx_refsource_BID |
| https://sympa.uninett.no/lists/uninett.no/arc/mod… | x_refsource_CONFIRM |
Date Public
2017-03-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:41:17.546Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1"
},
{
"name": "96843",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96843"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-14T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1"
},
{
"name": "96843",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96843"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6807",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1",
"refsource": "CONFIRM",
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1"
},
{
"name": "96843",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96843"
},
{
"name": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html",
"refsource": "CONFIRM",
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6807",
"datePublished": "2017-03-13T14:00:00.000Z",
"dateReserved": "2017-03-10T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:41:17.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-2146 (GCVE-0-2016-2146)
Vulnerability from nvd – Published: 2016-04-15 14:00 – Updated: 2024-08-05 23:17
VLAI
EPSS
VEX
Summary
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://sympa.uninett.no/lists/uninett.no/arc/mod… | mailing-listx_refsource_MLIST |
| https://github.com/UNINETT/mod_auth_mellon/pull/71 | x_refsource_CONFIRM |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
Date Public
2016-03-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:50.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-04-15T13:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-2146",
"datePublished": "2016-04-15T14:00:00.000Z",
"dateReserved": "2016-01-29T00:00:00.000Z",
"dateUpdated": "2024-08-05T23:17:50.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-2145 (GCVE-0-2016-2145)
Vulnerability from nvd – Published: 2016-04-15 14:00 – Updated: 2024-08-05 23:17
VLAI
EPSS
VEX
Summary
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://sympa.uninett.no/lists/uninett.no/arc/mod… | mailing-listx_refsource_MLIST |
| https://github.com/UNINETT/mod_auth_mellon/pull/71 | x_refsource_CONFIRM |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
Date Public
2016-03-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:50.820Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-04-15T13:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-2145",
"datePublished": "2016-04-15T14:00:00.000Z",
"dateReserved": "2016-01-29T00:00:00.000Z",
"dateUpdated": "2024-08-05T23:17:50.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-8566 (GCVE-0-2014-8566)
Vulnerability from nvd – Published: 2014-11-15 21:00 – Updated: 2024-08-06 13:18
VLAI
EPSS
VEX
Summary
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://linux.oracle.com/errata/ELSA-2014-1803.html | x_refsource_CONFIRM |
| http://rhn.redhat.com/errata/RHSA-2014-1803.html | vendor-advisoryx_refsource_REDHAT |
| https://github.com/UNINETT/mod_auth_mellon/releas… | x_refsource_CONFIRM |
| http://secunia.com/advisories/62094 | third-party-advisoryx_refsource_SECUNIA |
| http://secunia.com/advisories/62125 | third-party-advisoryx_refsource_SECUNIA |
| https://postlister.uninett.no/sympa/arc/modmellon… | mailing-listx_refsource_MLIST |
Date Public
2014-11-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:18:48.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a \"session overflow\" involving \"sessions overlapping in memory.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-11-19T20:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8566",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a \"session overflow\" involving \"sessions overlapping in memory.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://linux.oracle.com/errata/ELSA-2014-1803.html",
"refsource": "CONFIRM",
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1",
"refsource": "CONFIRM",
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1"
},
{
"name": "62094",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"refsource": "MLIST",
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8566",
"datePublished": "2014-11-15T21:00:00.000Z",
"dateReserved": "2014-10-31T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:18:48.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-8567 (GCVE-0-2014-8567)
Vulnerability from nvd – Published: 2014-11-14 15:00 – Updated: 2024-08-06 13:18
VLAI
EPSS
VEX
Summary
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://linux.oracle.com/errata/ELSA-2014-1803.html | x_refsource_CONFIRM |
| http://rhn.redhat.com/errata/RHSA-2014-1803.html | vendor-advisoryx_refsource_REDHAT |
| http://secunia.com/advisories/62094 | third-party-advisoryx_refsource_SECUNIA |
| http://secunia.com/advisories/62125 | third-party-advisoryx_refsource_SECUNIA |
| https://postlister.uninett.no/sympa/arc/modmellon… | mailing-listx_refsource_MLIST |
| https://github.com/UNINETT/mod_auth_mellon/commit… | x_refsource_CONFIRM |
Date Public
2014-11-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:18:48.670Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-11-19T20:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8567",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://linux.oracle.com/errata/ELSA-2014-1803.html",
"refsource": "CONFIRM",
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "62094",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"refsource": "MLIST",
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
},
{
"name": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647",
"refsource": "CONFIRM",
"url": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8567",
"datePublished": "2014-11-14T15:00:00.000Z",
"dateReserved": "2014-10-31T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:18:48.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2021-3639 (GCVE-0-2021-3639)
Vulnerability from cvelistv5 – Published: 2022-08-22 14:49 – Updated: 2024-08-03 17:01
VLAI
EPSS
VEX
Summary
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
Severity
No CVSS data available.
CWE
- CWE-601 - - URL Redirection to Untrusted Site ('Open Redirect')
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=1980648 | x_refsource_MISC |
| https://access.redhat.com/security/cve/CVE-2021-3639 | x_refsource_MISC |
| https://github.com/latchset/mod_auth_mellon/commi… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| n/a | mod_auth_mellon |
Affected:
Fixed in v0.18.0
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T17:01:07.702Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980648"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://access.redhat.com/security/cve/CVE-2021-3639"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/latchset/mod_auth_mellon/commit/42a11261b9dad2e48d70bdff7c53dd57a12db6f5"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mod_auth_mellon",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "Fixed in v0.18.0"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601 - URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-08-22T14:49:03.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1980648"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://access.redhat.com/security/cve/CVE-2021-3639"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/latchset/mod_auth_mellon/commit/42a11261b9dad2e48d70bdff7c53dd57a12db6f5"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2021-3639",
"datePublished": "2022-08-22T14:49:03.000Z",
"dateReserved": "2021-07-09T00:00:00.000Z",
"dateUpdated": "2024-08-03T17:01:07.702Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-3877 (GCVE-0-2019-3877)
Vulnerability from cvelistv5 – Published: 2019-03-27 12:19 – Updated: 2024-08-04 19:19
VLAI
EPSS
VEX
Summary
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Severity
5.8 (Medium)
CWE
Assigner
References
8 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_CONFIRM |
| https://github.com/Uninett/mod_auth_mellon/issues/35 | x_refsource_CONFIRM |
| https://github.com/Uninett/mod_auth_mellon/commit… | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3924-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://access.redhat.com/errata/RHSA-2019:0766 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:3421 | vendor-advisoryx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| uninett | mod_auth_mellon |
Affected:
v0.14.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:19:18.685Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Uninett/mod_auth_mellon/issues/35"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:3421",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3421"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mod_auth_mellon",
"vendor": "uninett",
"versions": [
{
"status": "affected",
"version": "v0.14.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-601",
"description": "CWE-601",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-11-06T00:06:36.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Uninett/mod_auth_mellon/issues/35"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:3421",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:3421"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2019-3877",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "mod_auth_mellon",
"version": {
"version_data": [
{
"version_value": "v0.14.2"
}
]
}
}
]
},
"vendor_name": "uninett"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "5.8/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-601"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877"
},
{
"name": "https://github.com/Uninett/mod_auth_mellon/issues/35",
"refsource": "CONFIRM",
"url": "https://github.com/Uninett/mod_auth_mellon/issues/35"
},
{
"name": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8",
"refsource": "CONFIRM",
"url": "https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8"
},
{
"name": "USN-3924-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0766",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:3421",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:3421"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2019-3877",
"datePublished": "2019-03-27T12:19:19.000Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-08-04T19:19:18.685Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2019-3878 (GCVE-0-2019-3878)
Vulnerability from cvelistv5 – Published: 2019-03-26 17:44 – Updated: 2024-08-04 19:19
VLAI
EPSS
VEX
Summary
A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
Severity
8.1 (High)
CWE
Assigner
References
9 references
| URL | Tags |
|---|---|
| https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2… | x_refsource_CONFIRM |
| https://github.com/Uninett/mod_auth_mellon/pull/196 | x_refsource_CONFIRM |
| https://usn.ubuntu.com/3924-1/ | vendor-advisoryx_refsource_UBUNTU |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://lists.fedoraproject.org/archives/list/pac… | vendor-advisoryx_refsource_FEDORA |
| https://access.redhat.com/errata/RHSA-2019:0746 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:0766 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHSA-2019:0985 | vendor-advisoryx_refsource_REDHAT |
| https://access.redhat.com/errata/RHBA-2019:0959 | vendor-advisoryx_refsource_REDHAT |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| uninett | mod_auth_mellon |
Affected:
before v0.14.2
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-04T19:19:18.665Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Uninett/mod_auth_mellon/pull/196"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0746",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0746"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:0985",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0985"
},
{
"name": "RHBA-2019:0959",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "https://access.redhat.com/errata/RHBA-2019:0959"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "mod_auth_mellon",
"vendor": "uninett",
"versions": [
{
"status": "affected",
"version": "before v0.14.2"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication."
}
],
"metrics": [
{
"cvssV3_0": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-305",
"description": "CWE-305",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2019-05-07T08:06:03.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Uninett/mod_auth_mellon/pull/196"
},
{
"name": "USN-3924-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0746",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0746"
},
{
"name": "RHSA-2019:0766",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:0985",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2019:0985"
},
{
"name": "RHBA-2019:0959",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHBA-2019:0959"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2019-3878",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "mod_auth_mellon",
"version": {
"version_data": [
{
"version_value": "before v0.14.2"
}
]
}
}
]
},
"vendor_name": "uninett"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication."
}
]
},
"impact": {
"cvss": [
[
{
"vectorString": "8.1/CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.0"
}
]
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-305"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878"
},
{
"name": "https://github.com/Uninett/mod_auth_mellon/pull/196",
"refsource": "CONFIRM",
"url": "https://github.com/Uninett/mod_auth_mellon/pull/196"
},
{
"name": "USN-3924-1",
"refsource": "UBUNTU",
"url": "https://usn.ubuntu.com/3924-1/"
},
{
"name": "FEDORA-2019-db1e9b3002",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/"
},
{
"name": "FEDORA-2019-2d8ee47f61",
"refsource": "FEDORA",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/"
},
{
"name": "RHSA-2019:0746",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0746"
},
{
"name": "RHSA-2019:0766",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0766"
},
{
"name": "RHSA-2019:0985",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHSA-2019:0985"
},
{
"name": "RHBA-2019:0959",
"refsource": "REDHAT",
"url": "https://access.redhat.com/errata/RHBA-2019:0959"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2019-3878",
"datePublished": "2019-03-26T17:44:29.000Z",
"dateReserved": "2019-01-03T00:00:00.000Z",
"dateUpdated": "2024-08-04T19:19:18.665Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2017-6807 (GCVE-0-2017-6807)
Vulnerability from cvelistv5 – Published: 2017-03-13 14:00 – Updated: 2024-08-05 15:41
VLAI
EPSS
VEX
Summary
mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://github.com/UNINETT/mod_auth_mellon/releas… | x_refsource_CONFIRM |
| http://www.securityfocus.com/bid/96843 | vdb-entryx_refsource_BID |
| https://sympa.uninett.no/lists/uninett.no/arc/mod… | x_refsource_CONFIRM |
Date Public
2017-03-13 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T15:41:17.546Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1"
},
{
"name": "96843",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/96843"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2017-03-13T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-03-14T09:57:01.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1"
},
{
"name": "96843",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/96843"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2017-6807",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "mod_auth_mellon before 0.13.1 is vulnerable to a Cross-Site Session Transfer attack, where a user with access to one web site running on a server can copy their session cookie to a different web site on the same server to get access to that site."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1",
"refsource": "CONFIRM",
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.13.1"
},
{
"name": "96843",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/96843"
},
{
"name": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html",
"refsource": "CONFIRM",
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2017-03/msg00008.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2017-6807",
"datePublished": "2017-03-13T14:00:00.000Z",
"dateReserved": "2017-03-10T00:00:00.000Z",
"dateUpdated": "2024-08-05T15:41:17.546Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-2145 (GCVE-0-2016-2145)
Vulnerability from cvelistv5 – Published: 2016-04-15 14:00 – Updated: 2024-08-05 23:17
VLAI
EPSS
VEX
Summary
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://sympa.uninett.no/lists/uninett.no/arc/mod… | mailing-listx_refsource_MLIST |
| https://github.com/UNINETT/mod_auth_mellon/pull/71 | x_refsource_CONFIRM |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
Date Public
2016-03-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:50.820Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-04-15T13:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-2145",
"datePublished": "2016-04-15T14:00:00.000Z",
"dateReserved": "2016-01-29T00:00:00.000Z",
"dateUpdated": "2024-08-05T23:17:50.820Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2016-2146 (GCVE-0-2016-2146)
Vulnerability from cvelistv5 – Published: 2016-04-15 14:00 – Updated: 2024-08-05 23:17
VLAI
EPSS
VEX
Summary
The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
3 references
| URL | Tags |
|---|---|
| https://sympa.uninett.no/lists/uninett.no/arc/mod… | mailing-listx_refsource_MLIST |
| https://github.com/UNINETT/mod_auth_mellon/pull/71 | x_refsource_CONFIRM |
| http://lists.fedoraproject.org/pipermail/package-… | vendor-advisoryx_refsource_FEDORA |
Date Public
2016-03-02 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-05T23:17:50.703Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA",
"x_transferred"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-03-02T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-04-15T13:57:01.000Z",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "[modmellon] 20160309 security update: mod_auth_mellon version 0.11.1",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://sympa.uninett.no/lists/uninett.no/arc/modmellon/2016-03/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/pull/71"
},
{
"name": "FEDORA-2016-5cf6959198",
"tags": [
"vendor-advisory",
"x_refsource_FEDORA"
],
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2016-March/179085.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-2146",
"datePublished": "2016-04-15T14:00:00.000Z",
"dateReserved": "2016-01-29T00:00:00.000Z",
"dateUpdated": "2024-08-05T23:17:50.703Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-8566 (GCVE-0-2014-8566)
Vulnerability from cvelistv5 – Published: 2014-11-15 21:00 – Updated: 2024-08-06 13:18
VLAI
EPSS
VEX
Summary
The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a "session overflow" involving "sessions overlapping in memory."
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://linux.oracle.com/errata/ELSA-2014-1803.html | x_refsource_CONFIRM |
| http://rhn.redhat.com/errata/RHSA-2014-1803.html | vendor-advisoryx_refsource_REDHAT |
| https://github.com/UNINETT/mod_auth_mellon/releas… | x_refsource_CONFIRM |
| http://secunia.com/advisories/62094 | third-party-advisoryx_refsource_SECUNIA |
| http://secunia.com/advisories/62125 | third-party-advisoryx_refsource_SECUNIA |
| https://postlister.uninett.no/sympa/arc/modmellon… | mailing-listx_refsource_MLIST |
Date Public
2014-11-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:18:48.643Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a \"session overflow\" involving \"sessions overlapping in memory.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-11-19T20:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8566",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to obtain sensitive information or cause a denial of service (segmentation fault) via unspecified vectors related to a \"session overflow\" involving \"sessions overlapping in memory.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://linux.oracle.com/errata/ELSA-2014-1803.html",
"refsource": "CONFIRM",
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1",
"refsource": "CONFIRM",
"url": "https://github.com/UNINETT/mod_auth_mellon/releases/tag/v0.8.1"
},
{
"name": "62094",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"refsource": "MLIST",
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8566",
"datePublished": "2014-11-15T21:00:00.000Z",
"dateReserved": "2014-10-31T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:18:48.643Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2014-8567 (GCVE-0-2014-8567)
Vulnerability from cvelistv5 – Published: 2014-11-14 15:00 – Updated: 2024-08-06 13:18
VLAI
EPSS
VEX
Summary
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Severity
No CVSS data available.
CWE
- n/a
Assigner
References
6 references
| URL | Tags |
|---|---|
| http://linux.oracle.com/errata/ELSA-2014-1803.html | x_refsource_CONFIRM |
| http://rhn.redhat.com/errata/RHSA-2014-1803.html | vendor-advisoryx_refsource_REDHAT |
| http://secunia.com/advisories/62094 | third-party-advisoryx_refsource_SECUNIA |
| http://secunia.com/advisories/62125 | third-party-advisoryx_refsource_SECUNIA |
| https://postlister.uninett.no/sympa/arc/modmellon… | mailing-listx_refsource_MLIST |
| https://github.com/UNINETT/mod_auth_mellon/commit… | x_refsource_CONFIRM |
Date Public
2014-11-03 00:00
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T13:18:48.670Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2014-11-03T00:00:00.000Z",
"descriptions": [
{
"lang": "en",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2014-11-19T20:57:00.000Z",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "62094",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2014-8567",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://linux.oracle.com/errata/ELSA-2014-1803.html",
"refsource": "CONFIRM",
"url": "http://linux.oracle.com/errata/ELSA-2014-1803.html"
},
{
"name": "RHSA-2014:1803",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1803.html"
},
{
"name": "62094",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62094"
},
{
"name": "62125",
"refsource": "SECUNIA",
"url": "http://secunia.com/advisories/62125"
},
{
"name": "[modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon",
"refsource": "MLIST",
"url": "https://postlister.uninett.no/sympa/arc/modmellon/2014-11/msg00000.html"
},
{
"name": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647",
"refsource": "CONFIRM",
"url": "https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2014-8567",
"datePublished": "2014-11-14T15:00:00.000Z",
"dateReserved": "2014-10-31T00:00:00.000Z",
"dateUpdated": "2024-08-06T13:18:48.670Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}