Important CentOS mod_auth_mellon Security Update

Metadata

critical
9.4
mod_auth_mellon-0.8.0-3.el6_6.i686.rpm, mod_auth_mellon-0.8.0-3.el6_6.src.rpm, mod_auth_mellon-0.8.0-3.el6_6.x86_64.rpm
CVE-2014-8566, CVE-2014-8567
rhn.redhat.com, lists.centos.org
2014-11-05
2017-07-27 19:08
CVE-2014-8567 libapache2-mod-auth-mellon
CVE-2014-8566 libapache2-mod-auth-mellon
CVE-2014-8566
CVE-2014-8567
2017-04-01 19:08
2017-01-05 20:12

Description


An updated mod_auth_mellon package that fixes two security issues is now
available for Red Hat Enterprise Linux 6.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

mod_auth_mellon provides a SAML 2.0 authentication module for the Apache
HTTP Server.

An information disclosure flaw was found in mod_auth_mellon's session
handling that could lead to sessions overlapping in memory. A remote
attacker could potentially use this flaw to obtain data from another user's
session. (CVE-2014-8566)

It was found that uninitialized data could be read when processing a user's
logout request. By attempting to log out, a user could possibly cause the
Apache HTTP Server to crash. (CVE-2014-8567)

Red Hat would like to thank the mod_auth_mellon team for reporting these
issues. Upstream acknowledges Matthew Slowe as the original reporter of
CVE-2014-8566.

All users of mod_auth_mellon are advised to upgrade to this updated
package, which contains a backported patch to correct these issues.
Please see https://www.redhat.com/footer/terms-of-use.html

Am I vulnerable?

The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.

Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.

Sign up for monitoring

Affected package information

Release Package Patched in
6 mod_auth_mellon mod_auth_mellon-0.8.0-3.el6_6.i686.rpm
mod_auth_mellon mod_auth_mellon-0.8.0-3.el6_6.src.rpm
mod_auth_mellon mod_auth_mellon-0.8.0-3.el6_6.x86_64.rpm