DEBIAN-CVE-2019-3877

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2019-3877
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2019-3877.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2019-3877
Upstream
Downstream
Published
2019-03-27T13:29:01Z
Modified
2026-09-09T07:01:47Z
Severity
  • 6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
[none]
Details

A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.

References

Affected packages

Debian:12 / libapache2-mod-auth-mellon

Package

Name
libapache2-mod-auth-mellon
Purl
pkg:deb/debian/libapache2-mod-auth-mellon?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.14.2-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2019-3877.json"

Debian:13 / libapache2-mod-auth-mellon

Package

Name
libapache2-mod-auth-mellon
Purl
pkg:deb/debian/libapache2-mod-auth-mellon?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.14.2-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2019-3877.json"

Debian:14 / libapache2-mod-auth-mellon

Package

Name
libapache2-mod-auth-mellon
Purl
pkg:deb/debian/libapache2-mod-auth-mellon?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
0.14.2-1

Ecosystem specific 

{
    "urgency":  "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2019-3877.json"