CVE-2019-3878
High
Description
A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
SeverityHigh
CVSS8.1
Exploit probability—
Product
Mod Auth Mellon
PublishedMar 26, 2019
First seenMar 26, 2019
Weakness typeCWE-305CWE-305
How to fix
Update
- mod_auth_mellon_project mod_auth_mellon0.14.2 or later
Vendor advisories
- usn.ubuntu.com/3924-1/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/
- access.redhat.com/errata/RHSA-2019:0746
- access.redhat.com/errata/RHSA-2019:0766
- access.redhat.com/errata/RHSA-2019:0985
- access.redhat.com/errata/RHBA-2019:0959
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mod_auth_mellon_project mod_auth_mellon | v < 0.14.2 | 0.14.2 |
| fedoraproject fedora | 29, 30 | — |
| redhat enterprise_linux | 7.0 | — |
| redhat enterprise_linux_desktop | 7.0 | — |
| redhat enterprise_linux_server | 7.0 | — |
| redhat enterprise_linux_server_aus | 7.6 | — |
| redhat enterprise_linux_server_eus | 7.6 | — |
| redhat enterprise_linux_server_tus | 7.6 | — |
| redhat enterprise_linux_workstation | 7.0 | — |
| canonical ubuntu_linux | 18.04, 18.10 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.