Explore top 10 tips to secure your open-source projects now. Read More

×
Alerts This Week
Warning Icon 1 547
Alerts This Week
Warning Icon 1 547

Fedora 23 - FEDORA-2016-5cf6959198 Moderate: mod_auth_mellon DOS Attack

fedora
Calendar Grey March 20, 2016
Dist Fedora Esm H88
This Ubuntu enhancement focuses on essential security patching in the OpenSSL library to bolster resilience against vulnerabilities.
[CVE-2016-2145] Fix DOS attack (Apache worker process crash) due to incorrect error handling when reading POST data from client

Summary

The mod_auth_mellon module is an authentication service that implements the

SAML 2.0 federation protocol. It grants access based on the attributes

received in assertions generated by a IdP server.

Update Information:

[CVE-2016-2145] Fix DOS attack (Apache worker process crash) due to incorrect error handling when reading POST data from client. [CVE-2016-2146] Fix DOS attack (Apache worker process crash resource exhaustion) due to missing size checks when reading POST data.

Topics%20covered

Topics Covered

security advisory Fedora Apache module resource exhaustion mod_auth_mellon DOS attack

Change Log

References


[ 1 ] Bug #1315747 - CVE-2016-2146 mod_auth_mellon: Failure to limit amount of POST data submitted by client https://bugzilla.redhat.com/show_bug.cgi?id=1315747 [ 2 ] Bug #1315739 - CVE-2016-2145 mod_auth_mellon: Missing error check when calling ap_get_client_block() https://bugzilla.redhat.com/show_bug.cgi?id=1315739

Update Instructions

This update can be installed with the "yum" update program. Use su -c 'yum update mod_auth_mellon' at the command line. For more information, refer to "Managing Software with yum", available at .

Name: mod_auth_mellon
Product: Fedora 23
Version: 0.11.1
Release: 1.fc23
URL: https://github.com/UNINETT/mod_auth_mellon
Summary: A SAML 2.0 authentication module for the Apache Httpd Server

Topics%20covered

Topics Covered

security advisory Fedora Apache module resource exhaustion mod_auth_mellon DOS attack

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.