Alerts This Week
Warning Icon 1 758
Alerts This Week
Warning Icon 1 758

Ubuntu: 4597-1 Critical: libapache2-mod-auth-mellon Session Attacks

ubuntu
Calendar Grey October 22, 2020
Dist Ubuntu Esm H88
Upgrade the libapache2-mod-auth-mellon packages to address severe security flaws impacting Ubuntu 16.04 LTS.
Several security issues were fixed in mod_auth_mellon.

Summary

Several security issues were fixed in mod_auth_mellon.

Software Description:

- libapache2-mod-auth-mellon: SAML 2.0 authentication module for Apache

Details:

François Kooman discovered that mod_auth_mellon incorrectly handled

cookies. An attacker could possibly use this issue to cause a Cross-Site

Session Transfer attack. (CVE-2017-6807)

It was discovered that mod_auth_mellon incorrectly handled certain requests.

An attacker could possibly use this issue to redirect a user to a malicious

URL. (CVE-2019-3877)

It was discovered that mod_auth_mellon incorrectly handled certain requests.

An attacker could possibly use this issue to access sensitive information.

(CVE-2019-3878)

Topics%20covered

Topics Covered

security advisory cross-site scripting Ubuntu sensitive data mod_auth_mellon session transfer

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 16.04 LTS:
  libapache2-mod-auth-mellon      0.12.0-2+deb9u1build0.16.04.1

In general, a standard system update will make all the necessary changes.

References

CVE-2017-6807, CVE-2019-3877, CVE-2019-3878

Severity
critical
Lowest
Low
Medium
High
Critical

October 22, 2020

Topics%20covered

Topics Covered

security advisory cross-site scripting Ubuntu sensitive data mod_auth_mellon session transfer

Package Information

https://launchpad.net/ubuntu/+source/libapache2-mod-auth-mellon/0.12.0-2+deb9u1build0.16.04.1

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here