USN-4597-1: mod_auth_mellon vulnerabilities

Releases

• Ubuntu 16.04 ESM

Packages

• libapache2-mod-auth-mellon - SAML 2.0 authentication module for Apache

Details

François Kooman discovered that mod_auth_mellon incorrectly handled
cookies. An attacker could possibly use this issue to cause a Cross-Site
Session Transfer attack. (CVE-2017-6807)

It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to redirect a user to a malicious
URL. (CVE-2019-3877)

It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2019-3878)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 16.04

• libapache2-mod-auth-mellon - 0.12.0-2+deb9u1build0.16.04.1

In general, a standard system update will make all the necessary changes.

References

• CVE-2019-3877
• CVE-2019-3878
• CVE-2017-6807

Related notices

• USN-3924-1: libapache2-mod-auth-mellon