CVE catalog

CVE-2019-3877

libapache2-mod-auth-mellon: CVE-2019-3877

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
2.12% · Oct 27, 2026

A vulnerability was found in mod_auth_mellon before v0.14.2. An open redirect in the logout URL allows requests with backslashes to pass through by assuming that it is a relative URL, while the browsers silently convert backslash characters into forward slashes treating them as an absolute URL. This mismatch allows an attacker to bypass the redirect URL validation logic in apr_uri_parse function.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianlibapache2-mod-auth-mellonsid0.19.1-1.1fixed
Debianlibapache2-mod-auth-mellonforky0.19.1-1.1fixed
Debianlibapache2-mod-auth-mellontrixie0.19.1-1fixed
Debianlibapache2-mod-auth-mellonbookworm0.18.1-1fixed
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1vulnerable
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1build1vulnerable
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1build2vulnerable
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1ubuntu0.1fixed
Ubuntulibapache2-mod-auth-mellon16.040.10.0-1vulnerable
Ubuntulibapache2-mod-auth-mellon16.040.11.0-1vulnerable
Ubuntulibapache2-mod-auth-mellon16.040.12.0-1vulnerable
Ubuntulibapache2-mod-auth-mellon16.040.12.0-2+deb9u1build0.16.04.1fixed
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1vulnerable
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1build1vulnerable
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1build2vulnerable
Ubuntulibapache2-mod-auth-mellon18.040.13.1-1ubuntu0.1fixed
Ubuntulibapache2-mod-auth-mellon20.040.14.2-1ubuntu1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianlibapache2-mod-auth-mellonsourcesid0.14.2-1not yet assignedNot reportedNot reported
Debianlibapache2-mod-auth-mellonsourceforky0.14.2-1not yet assignedNot reportedNot reported
Debianlibapache2-mod-auth-mellonsourcetrixie0.14.2-1not yet assignedNot reportedNot reported
Debianlibapache2-mod-auth-mellonsourcebookworm0.14.2-1not yet assignedNot reportedNot reported
Ubuntulibapache2-mod-auth-mellondeb18.040.13.1-1ubuntu0.1Not reportedUSN-3924-1Not reported
Ubuntulibapache2-mod-auth-mellondeb16.040.12.0-2+deb9u1build0.16.04.1Not reportedUBUNTU-CVE-2019-3877Not reported
Ubuntulibapache2-mod-auth-mellondeb18.040.13.1-1ubuntu0.1Not reportedUBUNTU-CVE-2019-3877Not reported
Ubuntulibapache2-mod-auth-mellondeb20.040.14.2-1ubuntu1Not reportedUBUNTU-CVE-2019-3877Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [libapache2-mod-auth-mellon]Fixed
    Details (2)

    • 0.18.1-1 · amd64 · bookworm

      Fixed · Fixed: 0.14.2-1

      dsa · libapache2-mod-auth-mellon · debian · bookworm; dsa · libapache2-mod-auth-mellon · debian · 12

    • 0.18.1-1 · arm64 · bookworm

      Fixed · Fixed: 0.14.2-1

      dsa · libapache2-mod-auth-mellon · debian · bookworm; dsa · libapache2-mod-auth-mellon · debian · 12

[Debian 13 (Trixie)]

  • [libapache2-mod-auth-mellon]Fixed

    Source package: [libapache2-mod-auth-mellon]

    Details (2)

    • 0.19.1-1 · amd64 · trixie

      Fixed · Fixed: 0.14.2-1

      dsa · libapache2-mod-auth-mellon · debian · 13

    • 0.19.1-1+b1 · arm64 · trixie

      Fixed · Fixed: 0.14.2-1

      dsa · libapache2-mod-auth-mellon · debian · 13

Observed:

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]