CVE-2016-2145 — Improper Input Validation in MOD Auth Mellon

CWE-20 — Improper Input ValidationCWE-391 — Unchecked Error Condition9 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.8%
top 25.84%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Uninett MOD Auth MellonFedoraproject Fedora
Timeline
PublishedApr 15
Latest updateMay 17

Description

The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check if the ap_get_client_block function returns an error, which allows remote attackers to cause a denial of service (segmentation fault and process crash) via a crafted POST data.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

Also affects: Fedora 23

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-c4mg-qw2m-q8mc: The am_read_post_data function in mod_auth_mellon before 0↗2022-05-17
▶
OSV
CVE-2016-2145: The am_read_post_data function in mod_auth_mellon before 0↗2016-04-15
▶
CVEList
CVE-2016-2145: The am_read_post_data function in mod_auth_mellon before 0↗2016-04-15
▶

📋Vendor Advisories

2
Red Hat
mod_auth_mellon: Missing error check when calling ap_get_client_block()↗2016-03-09
▶
Debian
CVE-2016-2145: libapache2-mod-auth-mellon - The am_read_post_data function in mod_auth_mellon before 0.11.1 does not check i...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-2145 mod_auth_mellon: Missing error check when calling ap_get_client_block() [fedora-all]↗2016-03-09
▶
Bugzilla
CVE-2016-2145 mod_auth_mellon: Missing error check when calling ap_get_client_block()↗2016-03-08
▶
Bugzilla
CVE-2016-2146 mod_auth_mellon: Failure to limit amount of POST data submitted by client↗2016-03-08
▶
CVE-2016-2145 — Improper Input Validation | cvebase