libapache2-mod-auth-mellon vulnerabilities

A security issue affects these releases of Ubuntu and its
derivatives:

* Ubuntu 16.04 LTS

Summary

Several security issues were fixed in mod_auth_mellon.

Software Description

* libapache2-mod-auth-mellon - SAML 2.0 authentication module
for Apache

Details

Fran**ois Kooman discovered that mod_auth_mellon incorrectly
handled cookies. An attacker could possibly use this issue to
cause a Cross-Site Session Transfer attack. (CVE-2017-6807)

It was discovered that mod_auth_mellon incorrectly handled certain
requests. An attacker could possibly use this issue to redirect a
user to a malicious URL. (CVE-2019-3877)

It was discovered that mod_auth_mellon incorrectly handled certain
requests. An attacker could possibly use this issue to access
sensitive information. (CVE-2019-3878)

Update instructions

The problem can be corrected by updating your system to the
following package versions:

Ubuntu 16.04 LTS
libapache2-mod-auth-mellon - 0.12.0-2+deb9u1build0.16.04.1

To update your system, please follow these instructions:
https://wiki.ubuntu.com/Security/Upgrades.

In general, a standard system update will make all the necessary
changes.

References

* CVE-2017-6807
* CVE-2019-3877
* CVE-2019-3878

--- Mystic BBS v1.12 A46 (Linux/64)
* Origin: BZ&BZ BBS (21:4/110)