CVE-2021-3639
Fixed in a distro release EPSS 1%
A flaw was found in mod_auth_mellon where it does not sanitize logout URLs properly. This issue could be used by an attacker to facilitate phishing attacks by tricking users into visiting a trusted web application URL that redirects to an external and potentially malicious server. The highest threat from this liability is to confidentiality and integrity.
Products: uninett mod_auth_mellon
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| AlmaLinux 8 | mod_auth_mellon | 0.14.0-12.el8.1 |
| AlmaLinux 8 | mod_auth_mellon-diagnostics | 0.14.0-12.el8.1 |
| Amazon Linux 2 | mod_auth_mellon | 0.14.0-9.amzn2.0.1 |
| Amazon Linux 2 | mod_auth_mellon-diagnostics | 0.14.0-9.amzn2.0.1 |
| Debian 10 | libapache2-mod-auth-mellon | 0.14.2-1+deb10u1 |
| Debian 12 | libapache2-mod-auth-mellon | 0.18.0-1 |
| Debian 13 | libapache2-mod-auth-mellon | 0.18.0-1 |
| Debian 14 | libapache2-mod-auth-mellon | 0.18.0-1 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon | 0:0.14.0-12.el8.1 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-debuginfo | 0:0.14.0-12.el8.1 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-debugsource | 0:0.14.0-12.el8.1 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-diagnostics | 0:0.14.0-12.el8.1 |
| Red Hat Enterprise Linux 8 | mod_auth_mellon-diagnostics-debuginfo | 0:0.14.0-12.el8.1 |
| Rocky Linux 8 | mod_auth_mellon | 0:0.14.0-12.el8.1 |
| SUSE Enterprise Storage 7 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP3 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Linux Enterprise Real Time 15 SP2 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Linux Enterprise Server 12 SP5 | apache2-mod_auth_mellon | 0.16.0-8.6.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP5 | apache2-mod_auth_mellon | 0.16.0-8.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Manager Proxy 4.1 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Manager Retail Branch Server 4.1 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| SUSE Manager Server 4.1 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| Ubuntu 16.04 LTS | libapache2-mod-auth-mellon | no fix |
| Ubuntu 18.04 LTS | libapache2-mod-auth-mellon | 0.13.1-1ubuntu0.3 |
| Ubuntu 20.04 LTS | libapache2-mod-auth-mellon | 0.16.0-1ubuntu0.1 |
| Ubuntu 22.04 LTS | libapache2-mod-auth-mellon | 0.17.0-1ubuntu1 |
| openSUSE Leap 15.3 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| openSUSE Leap 15.4 | apache2-mod_auth_mellon | 0.17.0-150200.5.7.1 |
| openSUSE Tumbleweed | apache2-mod_auth_mellon | 0.19.0-1.1 |