CVE-2019-3877
First published: Wed Mar 20 2019(Updated: )
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Mod Auth Mellon Project Mod Auth Mellon | <0.14.2 | |
| Fedoraproject Fedora | =29 | |
| Redhat Enterprise Linux | =7.0 | |
| Canonical Ubuntu Linux | =18.04 | |
| Canonical Ubuntu Linux | =18.10 | |
| redhat/mod_auth_mellon | <0.14.2 | 0.14.2 |
| ubuntu/libapache2-mod-auth-mellon | <0.13.1-1ubuntu0.1 | 0.13.1-1ubuntu0.1 |
| ubuntu/libapache2-mod-auth-mellon | <0.14.0-1ubuntu0.1 | 0.14.0-1ubuntu0.1 |
| ubuntu/libapache2-mod-auth-mellon | <0.14.2-1ubuntu1 | 0.14.2-1ubuntu1 |
| ubuntu/libapache2-mod-auth-mellon | <0.14.2-1ubuntu1 | 0.14.2-1ubuntu1 |
| ubuntu/libapache2-mod-auth-mellon | <0.14.2-1ubuntu1 | 0.14.2-1ubuntu1 |
| ubuntu/libapache2-mod-auth-mellon | <0.14.2-1ubuntu1 | 0.14.2-1ubuntu1 |
| ubuntu/libapache2-mod-auth-mellon | <0.14.2-1 | 0.14.2-1 |
| ubuntu/libapache2-mod-auth-mellon | <0.12.0-2+ | 0.12.0-2+ |
| debian/libapache2-mod-auth-mellon | 0.17.0-1+deb11u1 0.18.1-1 0.19.1-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://access.redhat.com/errata/RHSA-2019:0766
- https://access.redhat.com/errata/RHSA-2019:3421
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877
- https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8
- https://github.com/Uninett/mod_auth_mellon/issues/35
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/
- https://usn.ubuntu.com/3924-1/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1691771
- https://bugzilla.redhat.com/show_bug.cgi?id=1691125
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/
- https://ubuntu.com/security/notices/USN-3924-1
- https://ubuntu.com/security/notices/USN-4597-1
- https://www.cve.org/CVERecord?id=CVE-2019-3877
- https://nvd.nist.gov/vuln/detail/CVE-2019-3877
- https://launchpad.net/bugs/cve/CVE-2019-3877
- https://security-tracker.debian.org/tracker/CVE-2019-3877
- https://ubuntu.com/security/CVE-2019-3877
Frequently Asked Questions
What is CVE-2019-3877?
CVE-2019-3877 is a vulnerability found in mod_auth_mellon before v0.14.2.
What is the severity of CVE-2019-3877?
The severity of CVE-2019-3877 is medium with a CVSS score of 6.1.
How does CVE-2019-3877 affect mod_auth_mellon?
CVE-2019-3877 affects mod_auth_mellon before version 0.14.2.
How can I fix CVE-2019-3877?
To fix CVE-2019-3877, update mod_auth_mellon to version 0.14.2 or higher.
Where can I find more information about CVE-2019-3877?
You can find more information about CVE-2019-3877 at the following references: [Link 1], [Link 2], [Link 3].
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/weakness
- agent/author
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2019-3877
- agent/software-canonical-lookup
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/severity
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/softwarecombine
- agent/tags
- agent/description
- agent/event
- collector/launchpad-cve
- source/Launchpad
- collector/security-tracker-debian
- source/Debian
- collector/nvd-cve
- source/NVD
- vendor/mod auth mellon project
- canonical/mod auth mellon project mod auth mellon
- vendor/fedoraproject
- canonical/fedoraproject fedora
- version/fedoraproject fedora/29
- vendor/redhat
- canonical/redhat enterprise linux
- version/redhat enterprise linux/7.0
- vendor/canonical
- canonical/canonical ubuntu linux
- version/canonical ubuntu linux/18.04
- version/canonical ubuntu linux/18.10
- package-manager/redhat
- package-manager/ubuntu
- package-manager/debian