CVE-2016-2146 — Improper Restriction of Operations within the Bounds of a Memory Buffer in MOD Auth Mellon

CWE-119 — Improper Restriction of Operations within the Bounds of a Memory BufferCWE-20 — Improper Input Validation9 documents7 sources
Severity
7.5HIGHNVD
EPSS
0.6%
top 29.15%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Uninett MOD Auth MellonFedoraproject Fedora
Timeline
PublishedApr 15
Latest updateMay 17

Description

The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit the amount of data read, which allows remote attackers to cause a denial of service (worker process crash, web server deadlock, or memory consumption) via a large amount of POST data.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages1 packages

Also affects: Fedora 23

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-cm8g-34xp-fvpw: The am_read_post_data function in mod_auth_mellon before 0↗2022-05-17
▶
OSV
CVE-2016-2146: The am_read_post_data function in mod_auth_mellon before 0↗2016-04-15
▶
CVEList
CVE-2016-2146: The am_read_post_data function in mod_auth_mellon before 0↗2016-04-15
▶

📋Vendor Advisories

2
Red Hat
mod_auth_mellon: Failure to limit amount of POST data submitted by client↗2016-03-09
▶
Debian
CVE-2016-2146: libapache2-mod-auth-mellon - The am_read_post_data function in mod_auth_mellon before 0.11.1 does not limit t...↗2016
▶

💬Community

3
Bugzilla
CVE-2016-2146 mod_auth_mellon: Failure to limit amount of POST data submitted by client [fedora-all]↗2016-03-09
▶
Bugzilla
CVE-2016-2146 mod_auth_mellon: Failure to limit amount of POST data submitted by client↗2016-03-08
▶
Bugzilla
CVE-2016-2145 mod_auth_mellon: Missing error check when calling ap_get_client_block()↗2016-03-08
▶
CVE-2016-2146 — Uninett MOD Auth Mellon vulnerability | cvebase