Description
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| uninett | mod_auth_mellon | v0.14.2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | libapache2-mod-auth-mellon | 0.14.2-1 | — |
| Debian 13 | libapache2-mod-auth-mellon | 0.14.2-1 | — |
| Debian 12 | libapache2-mod-auth-mellon | 0.14.2-1 | — |
| Debian 9 | libapache2-mod-auth-mellon | 0.12.0-2+deb9u1 | DSA-4414-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | libapache2-mod-auth-mellon | 0.14.2-1ubuntu1 | — |
| Ubuntu 18.04 LTS | libapache2-mod-auth-mellon | 0.13.1-1ubuntu0.1 | USN-3924-1 |
| Ubuntu 16.04 LTS | libapache2-mod-auth-mellon | 0.12.0-2+deb9u1build0.16.04.1 | USN-4597-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 8 | mod_auth_mellon +1 | 0.14.0-9.el8 | RHSA-2019:3421 |
| RHEL 7 | mod_auth_mellon +1 | 0.14.0-2.el7_6.4 | RHSA-2019:0766 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | mod_auth_mellon +1 | 0.14.0-2.amzn2.4 | ALAS2-2019-1200 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 8 | mod_auth_mellon +1 | 0.14.0-9.el8 | ELSA-2019-3421 |
| Oracle Linux 7 | mod_auth_mellon +1 | 0.14.0-2.el7_6.4 | ELSA-2019-0766 |
Advisories 8
- RHSA-2019:0766 Red Hat Security Advisory: mod_auth_mellon security and bug fix update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-4414-1 libapache2-mod-auth-mellon - security update Debian Security (DSA / DLA) · Mar 9, 2026
- USN-4597-1 libapache2-mod-auth-mellon vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- USN-3924-1 libapache2-mod-auth-mellon vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- RHSA-2019:3421 Red Hat Security Advisory: mod_auth_mellon security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2019-3421 Moderate: mod_auth_mellon security, bug fix, and enhancement update (Oracle Linux 8) Oracle Linux Security Advisories (ELSA) · Nov 14, 2019
- ALAS2-2019-1200 Important: mod_auth_mellon security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · May 20, 2019
- ELSA-2019-0766 Important: mod_auth_mellon security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Apr 16, 2019
References
- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877
- https://github.com/Uninett/mod_auth_mellon/issues/35
- https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8
- USN-3924-1 vendor-advisory
- FEDORA-2019-db1e9b3002 vendor-advisory
- FEDORA-2019-2d8ee47f61 vendor-advisory
- RHSA-2019:0766 vendor-advisory
- RHSA-2019:3421 vendor-advisory