Important: Red Hat Security Advisory: mod_auth_mellon security and bug fix update

An update for modauthmellon is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

[SECURITY] Fedora 30 Update: mod_auth_mellon-0.14.2-1.fc30

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

[SECURITY] Fedora 29 Update: mod_auth_mellon-0.14.0-5.fc29

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

USN-3924-1: mod_auth_mellon vulnerabilities

It was discovered that modauthmellon incorrectly handled certain requests. An attacker could possibly use this issue to redirect a user to a malicious URL. CVE-2019-3877 It was discovered that modauthmellon incorrectly handled certain requests. An attacker could possibly use this issue to access...

Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server shipped with Jazz for Service Management (CVE-2018-1793)

Summary There is a potential cross-site scripting vulnerability in SAML ear in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1793 DESCRIPTION: IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed...

Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server shipped with Tivoli Integrated Portal (CVE-2018-1793)

Summary There is a potential Cross-site scripting vulnerability in SAML ear in WebSphere Application Server shipped with Tivoli Integrated Portal Vulnerability Details CVEID: CVE-2018-1793 DESCRIPTION: IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This...

CVE-2019-3878

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...

Authentication flaw

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...

DEBIAN-CVE-2019-3878

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...

CVE-2019-3878

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...

CVE-2019-3878

The CVE-2019-3878 issue affects mod_auth_mellon for Apache before v0.14.2. When Apache runs as a reverse proxy and mod_auth_mellon is set to require valid-user, an attacker can bypass authentication by sending specific HTTP headers used in SAML ECP (non-browser) flows. The connected advisories in...

CVE-2019-3878

A vulnerability was found in modauthmellon before v0.14.2. If Apache is configured as a reverse proxy and modauthmellon is configured to only let through authenticated users with the require valid-user directive, adding special HTTP headers that are normally used to start the special SAML ECP...

Debian DSA-4414-1 : libapache2-mod-auth-mellon - security update

Several issues have been discovered in Apache module authmellon, which provides SAML 2.0 authentication. - CVE-2019-3877 It was possible to bypass the redirect URL checking on logout, so the module could be used as an open redirect facility. - CVE-2019-3878 When modauthmellon is used in an Apache...

[SECURITY] [DSA 4414-1] libapache2-mod-auth-mellon security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4414-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst March 23, 2019 https://www.debian.org/security/faq -...

[SECURITY] [DSA 4414-1] libapache2-mod-auth-mellon security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4414-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst March 23, 2019 https://www.debian.org/security/faq -...

Debian: Security Advisory (DSA-4414-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

JFrog Artifactory Pro 6.5.9 Signature Validation

CVE-2018-19971: JFrog Artifactory Pro SAML SSO signature validation error ------------------------------------------------------------------------- Affected products ================= The SAML SSO addon in Artifactory 6.5.9 is vulnerable. The SAML SSO addon in Artifactory 6.5.13 is NOT vulnerable...

SAML vulnerability discovery and exploit-vulnerability warning-the black bar safety net

In a recent Web application testing process, I'm in the application of SAML-Security Assertion Markup Language implementation, found a security vulnerability. The application in achieving its SAML capabilities, using an unsafe practice, plus its own custom authentication mechanism is also present...

SAML Signature Relocation Attack

passport-wsfed-saml2 is vulnerable to SAML signature relocation attacks. The vulnerability exists as the validation function does not ensure that the Signature tag is in the correct location in an Assertion tag, allowing attackers to perform signature relocation attacks...

Security Bulletin: Cross-site scripting vulnerability in SAML ear in WebSphere Application Server (CVE-2018-1793)

Summary There is a potential cross-site scripting vulnerability in SAML ear in WebSphere Application Server. Vulnerability Details CVEID: CVE-2018-1793 DESCRIPTION: IBM WebSphere Application Server using SAML ear is vulnerable to cross-site scripting. This vulnerability allows users to embed...