Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:1524-1

Опубликовано: 04 мая 2022
Источник: suse-cvrf

Описание

Security update for apache2-mod_auth_mellon

This update for apache2-mod_auth_mellon fixes the following issues:

  • CVE-2021-3639: Fixed open Redirect vulnerability in logout URLs (bsc#1188926)

Список пакетов

SUSE Enterprise Storage 7
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise Module for Server Applications 15 SP3
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
apache2-mod_auth_mellon-diagnostics-0.17.0-150200.5.7.1
apache2-mod_auth_mellon-doc-0.17.0-150200.5.7.1
SUSE Linux Enterprise Real Time 15 SP2
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise Server 15 SP2-BCL
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise Server 15 SP2-LTSS
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise Server for SAP Applications 15 SP2
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Manager Proxy 4.1
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Manager Retail Branch Server 4.1
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Manager Server 4.1
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
openSUSE Leap 15.3
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
apache2-mod_auth_mellon-diagnostics-0.17.0-150200.5.7.1
apache2-mod_auth_mellon-doc-0.17.0-150200.5.7.1
openSUSE Leap 15.4
apache2-mod_auth_mellon-0.17.0-150200.5.7.1
apache2-mod_auth_mellon-diagnostics-0.17.0-150200.5.7.1
apache2-mod_auth_mellon-doc-0.17.0-150200.5.7.1

Ссылки

Описание

A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.

Затронутые продукты
SUSE Enterprise Storage 7:apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS:apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS:apache2-mod_auth_mellon-0.17.0-150200.5.7.1
SUSE Linux Enterprise Module for Server Applications 15 SP3:apache2-mod_auth_mellon-0.17.0-150200.5.7.1
Ссылки