CVE-2019-3878 Auth bypass in mod auth mellon

High 8.1 Published 26 Mar 2019 Updated 4 Aug 2024

Attackers can bypass authentication in mod_auth_mellon by sending special SAML ECP headers when Apache is configured as a reverse proxy.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2019-3878?

CVE-2019-3878 is a high-severity authentication bypass vulnerability in Canonical Ubuntu Linux, published on 26 Mar 2019. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.

Weakness: CWE-287, CWE-305

Which versions are affected by CVE-2019-3878?

It affects 10 products.

Linux distribution packages (4)

`mod_auth_mellon` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-3.el8_0.2`
`mod_auth_mellon-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-3.el8_0.2`
`mod_auth_mellon-debugsource` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-3.el8_0.2`
`mod_auth_mellon-diagnostics-debuginfo` Red Hat:enterprise_linux:8::appstream	All versions	`0:0.14.0-3.el8_0.2`

Products include Canonical Ubuntu Linux, Fedoraproject Fedora, Mod Auth Mellon Project Mod Auth Mellon, Redhat Enterprise Linux, Redhat Enterprise Linux Desktop, Redhat Enterprise Linux Server and 4 more.

How do I fix CVE-2019-3878?

Upgrade to a fixed version.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2019-3878 being exploited?

There is no known exploitation of CVE-2019-3878 in the wild and no public exploit code.

All Canonical Ubuntu Linux vulnerabilities

Sources

Also known as DEBIAN-CVE-2019-3878, GHSA-6gx9-985p-w8c8, RHSA-2019:0985, UBUNTU-CVE-2019-3878.