high
8.1
CWE
287 305
Advisory Published
CVE Published
CVE Published
Updated

CVE-2019-3878

First published: Wed Mar 20 2019(Updated: )

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

Credit: secalert@redhat.com secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
Mod Auth Mellon Project Mod Auth Mellon<0.14.2
Fedoraproject Fedora=29
Fedoraproject Fedora=30
Redhat Enterprise Linux=7.0
Redhat Enterprise Linux Desktop=7.0
Redhat Enterprise Linux Server=7.0
Redhat Enterprise Linux Server Aus=7.6
Redhat Enterprise Linux Server Eus=7.6
Redhat Enterprise Linux Server Tus=7.6
Redhat Enterprise Linux Workstation=7.0
Canonical Ubuntu Linux=18.04
Canonical Ubuntu Linux=18.10
redhat/mod_auth_mellon<0.14.2
0.14.2
ubuntu/libapache2-mod-auth-mellon<0.13.1-1ubuntu0.1
0.13.1-1ubuntu0.1
ubuntu/libapache2-mod-auth-mellon<0.14.0-1ubuntu0.1
0.14.0-1ubuntu0.1
ubuntu/libapache2-mod-auth-mellon<0.14.2-1ubuntu1
0.14.2-1ubuntu1
ubuntu/libapache2-mod-auth-mellon<0.14.2-1ubuntu1
0.14.2-1ubuntu1
ubuntu/libapache2-mod-auth-mellon<0.14.2-1ubuntu1
0.14.2-1ubuntu1
ubuntu/libapache2-mod-auth-mellon<0.14.2-1ubuntu1
0.14.2-1ubuntu1
ubuntu/libapache2-mod-auth-mellon<0.12.0-2+
0.12.0-2+
debian/libapache2-mod-auth-mellon
0.17.0-1+deb11u1
0.18.1-1
0.19.1-1

Remedy

https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878

Remedy

https://github.com/Uninett/mod_auth_mellon/pull/196

Remedy

https://github.com/Uninett/mod_auth_mellon/commit/e09a28a30e13e5c22b481010f26b4a7743a09280

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Parent vulnerabilities

(Appears in the following advisories)

Frequently Asked Questions

  • What is the severity of CVE-2019-3878?

    The severity of CVE-2019-3878 is high with a CVSS score of 8.1.

  • How does the vulnerability CVE-2019-3878 affect mod_auth_mellon?

    The vulnerability CVE-2019-3878 affects mod_auth_mellon versions before v0.14.2.

  • What is the recommended version to fix CVE-2019-3878?

    To fix CVE-2019-3878, it is recommended to update to mod_auth_mellon v0.14.2 or later.

  • How can I mitigate the risk of CVE-2019-3878?

    To mitigate the risk of CVE-2019-3878, you should update mod_auth_mellon to version 0.14.2 or apply the necessary patches.

  • Are there any references available for CVE-2019-3878?

    Yes, you can find references for CVE-2019-3878 at the following links: [link1], [link2], [link3].

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2024 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203