Description
The mod_auth_mellon module before 0.8.1 allows remote attackers to cause a denial of service (Apache HTTP server crash) via a crafted logout request that triggers a read of uninitialized data.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-auth-mellon | 0.9.0 | — |
| Debian 13 | libapache2-mod-auth-mellon | 0.9.0 | — |
| Debian 12 | libapache2-mod-auth-mellon | 0.9.0 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 6 | mod_auth_mellon | 0.8.0-3.el6_6 | RHSA-2014:1803 |
Advisories 1
- RHSA-2014:1803 Red Hat Security Advisory: mod_auth_mellon security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
References
- http://linux.oracle.com/errata/ELSA-2014-1803.html
- RHSA-2014:1803 vendor-advisory
- 62094 third-party-advisory
- 62125 third-party-advisory
- [modmellon] 20141103 Information disclosure vulnerability in version 0.8.0 of mod_auth_mellon mailing-list
- https://github.com/UNINETT/mod_auth_mellon/commit/0f5b4fd860fa7e3a6c47201637aab05395f32647