Homepage

Improper Authentication Affecting libapache2-mod-auth-mellon package, versions <0.14.2-1ubuntu1

Severity

 Recommended
medium

Based on Ubuntu security rating.

Threat Intelligence

EPSS
0.95% (84th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications

Snyk Learn

Learn about Improper Authentication vulnerabilities in an interactive lesson.

Start learning
  • Snyk IDSNYK-UBUNTU1904-LIBAPACHE2MODAUTHMELLON-527564
  • published22 Mar 2019
  • disclosed26 Mar 2019
Report a new vulnerability Found a mistake?

Introduced: 22 Mar 2019

CVE-2019-3878  (opens in a new tab)
CWE-287  (opens in a new tab)

How to fix?

Upgrade Ubuntu:19.04 libapache2-mod-auth-mellon to version 0.14.2-1ubuntu1 or higher.

NVD Description

Note: Versions mentioned in the description apply only to the upstream libapache2-mod-auth-mellon package and not the libapache2-mod-auth-mellon package as distributed by Ubuntu. See How to fix? for Ubuntu:19.04 relevant fixed versions and status.

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

References