Summary
[0.14.0-9]
- Just bump the release number
- Related: rhbz#1718238 - mod_auth_mellon-diagnostics RPM not in product
listings
[0.14.0-8]
- Resolves: rhbz#1691894 - [RFE] Config option to change mod_auth_mellon prefix
[0.14.0-7]
- Apply the patch from the previous commit
- Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
redirect in logout url when using URLs with
backslashes [rhel-8]
[0.14.0-6]
- Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
redirect in logout url when using URLs with
backslashes [rhel-8]
[0.14.0-5]
- Resolves: rhbz#1692457 - CVE-2019-3878 mod_auth_mellon: authentication
bypass in ECP flow [rhel-8.1.0]
[0.14.0-4]
- Resolves: rhbz#1702695 - fresh install of mod_auth_mellon shows rpm
verification warnings
Fixed packages 2
| Release | Package | Fixed in |
|---|---|---|
| Oracle Linux · 8 | mod_auth_mellon | 0:0.14.0-9.el8 |
| Oracle Linux · 8 | mod_auth_mellon-diagnostics | 0:0.14.0-9.el8 |
Vulnerabilities 1
-
Medium 5.8
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with ba…