Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

oracle-oval логотип

ELSA-2019-0985

Опубликовано: 30 июл. 2019
Источник: oracle-oval
Платформа: Oracle Linux 8

Описание

ELSA-2019-0985: mod_auth_mellon security update (IMPORTANT)

[0.14.0-3.2]

  • Resolves: rhbz#1696197 - CVE-2019-3878 mod_auth_mellon: authentication bypass in ECP flow [rhel-8.0.0.z]

Обновленные пакеты

Oracle Linux 8

Oracle Linux aarch64

mod_auth_mellon

0.14.0-3.el8_0.2

Oracle Linux x86_64

mod_auth_mellon

0.14.0-3.el8_0.2

Связанные CVE

Связанные уязвимости

CVSS3: 8.1
ubuntu
почти 7 лет назад

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

CVSS3: 8.1
redhat
больше 7 лет назад

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

CVSS3: 8.1
nvd
почти 7 лет назад

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

CVSS3: 8.1
debian
почти 7 лет назад

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache ...

CVSS3: 8.1
github
больше 3 лет назад

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.