Red Hat Security AdvisoryRHSA-2020:1003
mod_auth_mellon security and bug fix update
Released 2020-03-31 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Enterprise Linux Server (v. 7) mod_auth_mellon-0.14.0-8.el7, mod_auth_mellon-diagnostics-0.14.0-8.el7
- Red Hat Enterprise Linux Workstation (v. 7) mod_auth_mellon-0.14.0-8.el7, mod_auth_mellon-diagnostics-0.14.0-8.el7
Fixes 1 record
Priority LOW 30
mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.01423 · Published 2019-06-29 · Partial fix CWE-601
