CVE-2019-3877
published 2019-03-27CVE-2019-3877: A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming…
PriorityP428medium6.1CVSS 3.0
AVNACLPRNUIRSCCLILAN
EPSS
2.13%
79.9th percentile
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | libapache2-mod-auth-mellon | < libapache2-mod-auth-mellon 0.14.2-1 (bookworm) | libapache2-mod-auth-mellon 0.14.2-1 (bookworm) |
| debian | libapache2-mod-auth-openidc | < libapache2-mod-auth-openidc 2.4.0.3-1 (bookworm) | libapache2-mod-auth-openidc 2.4.0.3-1 (bookworm) |
| fedoraproject | fedora | — | — |
| mod_auth_mellon_project | mod_auth_mellon | < 0.14.2 | 0.14.2 |
| openidc | mod_auth_openidc | < 2.4.0.1 | 2.4.0.1 |
| redhat | enterprise_linux | — | — |
| uninett | mod_auth_mellon | — | — |
CVSS provenance
nvdv3.06.1MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
vendor_ubuntu6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
mod_auth_mellon vulnerabilities
vendor_ubuntu·2020-10-22·CVSS 6.1
CVE-2019-3877 [MEDIUM] mod_auth_mellon vulnerabilities
Title: mod_auth_mellon vulnerabilities
Summary: Several security issues were fixed in mod_auth_mellon.
François Kooman discovered that mod_auth_mellon incorrectly handled
cookies. An attacker could possibly use this issue to cause a Cross-Site
Session Transfer attack. (CVE-2017-6807)
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to redirect a user to a malicious
URL. (CVE-2019-3877)
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2019-3878)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
vendor_redhat·2019-10-02·CVSS 6.1
CVE-2019-14857 [MEDIUM] CWE-601 mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
An open redirect flaw was discovered in mod_auth_openidc, where it handles logout redirection. The module does not correctly validate the URL, allowing a URL with leading slashes to bypass the protection checks. A victim user may be tricked into visiting a trusted vulnerable web site, which would redirect them to another possibly malicious URL.
Statement: It is not possible to reproduce the open redirect vulnerability in the versions of mod_auth_openidc as shipped in Red Hat Enterprise Linux 7, as a missing check makes the process crash, due
Ubuntu
mod_auth_mellon vulnerabilities
vendor_ubuntu·2019-03-28·CVSS 5.8
CVE-2019-3877 [MEDIUM] mod_auth_mellon vulnerabilities
Title: mod_auth_mellon vulnerabilities
Summary: Several security issues were fixed in mod_auth_mellon.
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to redirect a user to a malicious
URL. (CVE-2019-3877)
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2019-3878)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
mod_auth_mellon: open redirect in logout url when using URLs with backslashes
vendor_redhat·2019-03-22·CVSS 5.8
CVE-2019-3877 [MEDIUM] CWE-601 mod_auth_mellon: open redirect in logout url when using URLs with backslashes
mod_auth_mellon: open redirect in logout url when using URLs with backslashes
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Package: mod_auth_mellon (Red Hat Enterprise Linux 6) - Will not fix
Package: httpd24-mod_auth_mellon (Red Hat Software Collections) - Will not fix
Debian
CVE-2019-3877: libapache2-mod-auth-mellon - A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in...
vendor_debian·2019·CVSS 5.8
CVE-2019-3877 [MEDIUM] CVE-2019-3877: libapache2-mod-auth-mellon - A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in...
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Scope: local
bookworm: resolved (fixed in 0.14.2-1)
bullseye: resolved (fixed in 0.14.2-1)
forky: resolved (fixed in 0.14.2-1)
sid: resolved (fixed in 0.14.2-1)
trixie: resolved (fixed in 0.14.2-1)
Debian
CVE-2019-14857: libapache2-mod-auth-openidc - A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect is...
vendor_debian·2019·CVSS 6.1
CVE-2019-14857 [MEDIUM] CVE-2019-14857: libapache2-mod-auth-openidc - A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect is...
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
Scope: local
bookworm: resolved (fixed in 2.4.0.3-1)
bullseye: resolved (fixed in 2.4.0.3-1)
forky: resolved (fixed in 2.4.0.3-1)
sid: resolved (fixed in 2.4.0.3-1)
trixie: resolved (fixed in 2.4.0.3-1)
GHSA
GHSA-qr9h-f4fq-2h85: A vulnerability was found in mod_auth_mellon before v0
ghsa_unreviewed·2022-05-14
CVE-2019-3877 [MEDIUM] CWE-601 GHSA-qr9h-f4fq-2h85: A vulnerability was found in mod_auth_mellon before v0
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
OSV
libapache2-mod-auth-mellon vulnerabilities
osv·2020-10-22·CVSS 6.1
CVE-2017-6807 [MEDIUM] libapache2-mod-auth-mellon vulnerabilities
libapache2-mod-auth-mellon vulnerabilities
François Kooman discovered that mod_auth_mellon incorrectly handled
cookies. An attacker could possibly use this issue to cause a Cross-Site
Session Transfer attack. (CVE-2017-6807)
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to redirect a user to a malicious
URL. (CVE-2019-3877)
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2019-3878)
OSV
CVE-2019-14857: A flaw was found in mod_auth_openidc before version 2
osv·2019-11-26·CVSS 6.1
CVE-2019-14857 [MEDIUM] CVE-2019-14857: A flaw was found in mod_auth_openidc before version 2
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
OSV
libapache2-mod-auth-mellon vulnerabilities
osv·2019-03-28·CVSS 6.1
CVE-2019-3877 [MEDIUM] libapache2-mod-auth-mellon vulnerabilities
libapache2-mod-auth-mellon vulnerabilities
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to redirect a user to a malicious
URL. (CVE-2019-3877)
It was discovered that mod_auth_mellon incorrectly handled certain requests.
An attacker could possibly use this issue to access sensitive information.
(CVE-2019-3878)
OSV
CVE-2019-3877: A vulnerability was found in mod_auth_mellon before v0
osv·2019-03-27·CVSS 6.1
CVE-2019-3877 [MEDIUM] CVE-2019-3877: A vulnerability was found in mod_auth_mellon before v0
A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-14857 mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
bugzilla·2019-10-10·CVSS 6.1
CVE-2019-14857 [MEDIUM] CVE-2019-14857 mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
CVE-2019-14857 mod_auth_openidc: Open redirect in logout url when using URLs with leading slashes
A flaw was found in mod_auth_openidc before version 2.4.0.1. An open redirect issue exists in URLs with trailing slashes similar to CVE-2019-3877 in mod_auth_mellon.
Upstream patch:
https://github.com/zmartzone/mod_auth_openidc/commit/5c15dfb08106c2451c2c44ce7ace6813c216ba75
https://github.com/zmartzone/mod_auth_openidc/commit/ce37080c6aea30aabae8b4a9b4eea7808445cc8e
https://github.com/zmartzone/mod_auth_openidc/pull/451
References:
https://groups.google.com/forum/#!topic/mod_auth_openidc/boy1Ba3Gdk4
Discussion:
Created mod_auth_openidc tracking bugs for this issue:
Affects: fedora-all [bug 1760614]
---
The version of mod_auth_openidc as shipped with Red Hat Enterprise Linux 7 does n
Bugzilla
CVE-2019-13038 mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft
bugzilla·2019-07-01·CVSS 6.1
CVE-2019-13038 [MEDIUM] CVE-2019-13038 mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft
CVE-2019-13038 mod_auth_mellon: Open Redirect via the login?ReturnTo= substring which could facilitate information theft
mod_auth_mellon through 0.14.2 has an Open Redirect via the login?ReturnTo= substring, as demonstrated by omitting the // after http: in the target URL.
Upstream Issue:
https://github.com/Uninett/mod_auth_mellon/issues/35
Discussion:
Created mod_auth_mellon tracking bugs for this issue:
Affects: fedora-all [bug 1725742]
---
An initial patch can be found at https://github.com/Uninett/mod_auth_mellon/commit/9d28908e28ef70a12196c215503fb0075e1fd7f3 . However, according to https://github.com/Uninett/mod_auth_mellon/issues/35#issuecomment-503974885 it is still possible to reproduce the flaw.
---
By omitting the `//` after `http:` or `https:` apr_uri_parse() function
Bugzilla
CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes [fedora-all]
bugzilla·2019-03-22·CVSS 5.8
CVE-2019-3877 [MEDIUM] CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes [fedora-all]
CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects
Bugzilla
CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes
bugzilla·2019-03-20·CVSS 5.8
CVE-2019-3877 [MEDIUM] CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes
CVE-2019-3877 mod_auth_mellon: open redirect in logout url when using URLs with backslashes
A vulnerability was found in mod_auth_mellon. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes using treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.
Discussion:
Upstream issue:
https://github.com/Uninett/mod_auth_mellon/issues/35
---
Upstream Patch:
https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8
---
Created mod_auth_mellon tracking bugs for this issue:
Affects: fedora-all [bug 1691771]
---
This issue has been
arXiv
Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories
arxiv_fulltext·2025-03-18
Benchmarking LLMs and LLM-based Agents in Practical Vulnerability Detection for Code Repositories
## Abstract
Large Language Models (LLMs) have shown promise in software vulnerability detection, particularly on function-level benchmarks like Devign and BigVul. However, real-world detection requires interprocedural analysis, as vulnerabilities often emerge through multi-hop function calls rather than isolated functions. While repository-level benchmarks like ReposVul and VulEval introduce interprocedural context, they remain computationally expensive, lack pairwise evaluation of vulnerability fixes, and explore limited context retrieval, limiting their practicality.
We introduce , a JIT vulnerability detection benchmark linking each function to its vulnerability-introducing and fixing commits. Built from 879 CVEs spanning 91 vulnerability types, enables comprehensive evaluation of det
https://access.redhat.com/errata/RHSA-2019:0766https://access.redhat.com/errata/RHSA-2019:3421https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8https://github.com/Uninett/mod_auth_mellon/issues/35https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/https://usn.ubuntu.com/3924-1/https://access.redhat.com/errata/RHSA-2019:0766https://access.redhat.com/errata/RHSA-2019:3421https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3877https://github.com/Uninett/mod_auth_mellon/commit/62041428a32de402e0be6ba45fe12df6a83bedb8https://github.com/Uninett/mod_auth_mellon/issues/35https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CNW5YMC5TLWVWNJEY6AIWNSNPRAMWPQJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X7NLAU7KROWNTHAYSA2S67X347F42L2I/https://usn.ubuntu.com/3924-1/
2019-03-27
Published