Skip to content
OpenAdvisories
Medium ELSA-2019-3421 1 CVE

Moderate: mod_auth_mellon security, bug fix, and enhancement update (Oracle Linux 8)

Published Nov 14, 2019 · Updated Nov 14, 2019

Summary

[0.14.0-9]
- Just bump the release number
- Related: rhbz#1718238 - mod_auth_mellon-diagnostics RPM not in product
listings

[0.14.0-8]
- Resolves: rhbz#1691894 - [RFE] Config option to change mod_auth_mellon prefix

[0.14.0-7]
- Apply the patch from the previous commit
- Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
redirect in logout url when using URLs with
backslashes [rhel-8]

[0.14.0-6]
- Resolves: rhbz#1692471 - CVE-2019-3877 appstream/mod_auth_mellon: open
redirect in logout url when using URLs with
backslashes [rhel-8]

[0.14.0-5]
- Resolves: rhbz#1692457 - CVE-2019-3878 mod_auth_mellon: authentication
bypass in ECP flow [rhel-8.1.0]

[0.14.0-4]
- Resolves: rhbz#1702695 - fresh install of mod_auth_mellon shows rpm
verification warnings

Fixed packages 2

ReleasePackageFixed in
Oracle Linux · 8 mod_auth_mellon 0:0.14.0-9.el8
Oracle Linux · 8 mod_auth_mellon-diagnostics 0:0.14.0-9.el8

Vulnerabilities 1