Important CentOS mod_auth_mellon Security Update
|mod_auth_mellon-0.8.0-3.el6_6.i686.rpm, mod_auth_mellon-0.8.0-3.el6_6.src.rpm, mod_auth_mellon-0.8.0-3.el6_6.x86_64.rpm|
An updated mod_auth_mellon package that fixes two security issues is now
available for Red Hat Enterprise Linux 6.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
mod_auth_mellon provides a SAML 2.0 authentication module for the Apache
An information disclosure flaw was found in mod_auth_mellon's session
handling that could lead to sessions overlapping in memory. A remote
attacker could potentially use this flaw to obtain data from another user's
It was found that uninitialized data could be read when processing a user's
logout request. By attempting to log out, a user could possibly cause the
Apache HTTP Server to crash. (CVE-2014-8567)
Red Hat would like to thank the mod_auth_mellon team for reporting these
issues. Upstream acknowledges Matthew Slowe as the original reporter of
All users of mod_auth_mellon are advised to upgrade to this updated
package, which contains a backported patch to correct these issues.
Please see https://www.redhat.com/footer/terms-of-use.html
Am I vulnerable?
The constraints below list the versions that this vulnerability is patched in, and versions that are unaffected. If a patch is ready but unrealeased, then it is pending.
Or, you can just let us figure it out for you! Appcanary continously monitor your installed packages, and tell you if any of them are vulnerable.Sign up for monitoring
Affected package information