UbuntuUpdates.org

Package "libapache2-mod-auth-mellon"

Name: libapache2-mod-auth-mellon

Description:

SAML 2.0 authentication module for Apache
Latest version: 0.13.1-1ubuntu0.3
Release: bionic (18.04)
Level: security
Repository: main
Homepage: https://github.com/UNINETT/mod_auth_mellon

Links

All versions of this package
Bug fixes

List of files in package
Repository home page

Download "libapache2-mod-auth-mellon"

32-bit deb package
64-bit deb package
APT INSTALL

Other versions of "libapache2-mod-auth-mellon" in Bionic

Repository Area Version
base main 0.13.1-1build2
updates main 0.13.1-1ubuntu0.3

Changelog

Version: 0.13.1-1ubuntu0.3 2021-09-08 13:06:37 UTC

  libapache2-mod-auth-mellon (0.13.1-1ubuntu0.3) bionic-security; urgency=medium

  * SECURITY UPDATE: open redirect vulnerability
    - debian/patches/CVE-2021-3639.patch: prevent redirect to URLs that
      begin with /// in auth_mellon_util.c.
    - CVE-2021-3639

 -- Marc Deslauriers <email address hidden> Wed, 04 Aug 2021 10:17:24 -0400
Source diff to previous version
CVE-2021-3639 Prevent redirect to URLs that begin with '///'

Version: 0.13.1-1ubuntu0.2 2020-02-24 17:06:41 UTC

  libapache2-mod-auth-mellon (0.13.1-1ubuntu0.2) bionic-security; urgency=medium

  * SECURITY UPDATE: open redirect issue
    - debian/patches/CVE-2019-13038-1.patch: prevent schemes without
      hostname in auth_mellon_util.c.
    - debian/patches/CVE-2019-13038-2.patch: add error message in
      auth_mellon_util.c.
    - CVE-2019-13038

 -- Marc Deslauriers <email address hidden> Fri, 22 Nov 2019 12:44:27 -0500
Source diff to previous version
CVE-2019-13038 mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target U

Version: 0.13.1-1ubuntu0.1 2019-03-28 15:06:34 UTC

  libapache2-mod-auth-mellon (0.13.1-1ubuntu0.1) bionic-security; urgency=medium

  * SECURITY UPDATE: Open redirect in logout
    - debian/patches/CVE-2019-3877.patch: fix in
      auth_mellon_util.c.
    - CVE-2019-3877
  * SECURITY UPDATE: Authentication bypass
    - debian/patches/CVE-2019-3878.patch: fix in
      mod_auth_mellon.c.
    - CVE-2019-3878

 -- <email address hidden> (Leonidas S. Barbosa) Wed, 27 Mar 2019 10:36:21 -0300
CVE-2019-3877 A vulnerability was found in mod_auth_mellon before v0.14.2. An open r ...
CVE-2019-3878 A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let


About   -   Send Feedback to @ubuntu_updates