Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2021-3639: A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | mod_auth_mellon | 0:0.14.0-9.amzn2.0.1 |
| Amazon Linux · 2 | mod_auth_mellon-debuginfo | 0:0.14.0-9.amzn2.0.1 |
| Amazon Linux · 2 | mod_auth_mellon-diagnostics | 0:0.14.0-9.amzn2.0.1 |
Vulnerabilities 1
-
Unscored —
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an att…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2021-3639.html