CVE-2019-13038
Fixed in a distro release EPSS 1%
mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.
Products: mod_auth_mellon_project mod_auth_mellon, oracle zfs_storage_appliance_kit, fedoraproject fedora, canonical ubuntu_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | mod_auth_mellon | 0.14.0-8.amzn2 |
| Amazon Linux 2 | mod_auth_mellon-diagnostics | 0.14.0-8.amzn2 |
| Debian 10 | libapache2-mod-auth-mellon | 0.14.2-1+deb10u1 |
| Debian 12 | libapache2-mod-auth-mellon | 0.15.0-1 |
| Debian 13 | libapache2-mod-auth-mellon | 0.15.0-1 |
| Debian 14 | libapache2-mod-auth-mellon | 0.15.0-1 |
| Red Hat Enterprise Linux 7 | mod_auth_mellon | 0:0.14.0-8.el7 |
| Red Hat Enterprise Linux 7 | mod_auth_mellon-debuginfo | 0:0.14.0-8.el7 |
| Red Hat Enterprise Linux 7 | mod_auth_mellon-diagnostics | 0:0.14.0-8.el7 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon | 0:0.14.0-11.el8 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-debuginfo | 0:0.14.0-11.el8 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-debugsource | 0:0.14.0-11.el8 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-diagnostics | 0:0.14.0-11.el8 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-diagnostics-debuginfo | 0:0.14.0-11.el8 |
| Ubuntu 16.04 LTS | libapache2-mod-auth-mellon | no fix |
| Ubuntu 18.04 LTS | libapache2-mod-auth-mellon | 0.13.1-1ubuntu0.2 |
| Ubuntu 20.04 LTS | libapache2-mod-auth-mellon | 0.14.2-1ubuntu2 |