Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [day] [month] [year] [list]
Date: Tue, 04 Nov 2014 12:53:43 +1100
From: Murray McAllister <>
Subject: CVE-2014-8566 and CVE-2014-8567: mod_auth_mellon issues affecting
 users of 0.8.0

Good morning,

mod_auth_mellon provides a SAML 2.0 authentication module for the Apache 
HTTP Server.

The below issues were fixed in the 0.9.0 and
0.9.1 releases, but not marked as security issues at the time. (An 0.8.1 
security update has been released too, 

While Red Hat ship version 0.8.0, it is expected that very few others 
would have been using this version (if any).


It turned out that session overflow bugs fixes in version 0.9.0 and
0.9.1 can lead to information disclosure, where data from one session
is leaked to another session. Depending on how this data is used by the
web application, this may lead to data from one session being disclosed
to an user in a different session. (CVE-2014-8566)

In addition to the information disclosure, this release contains some
fixes for logout processing, where logout requests would crash the
Apache web server. (CVE-2014-8567)

You may also come across 
<>. I originally 
could lead to a predictable session cookie being returned, but it turns 
out that is not the case (and MITRE did not assign a CVE for this change).


Murray McAllister / Red Hat Product Security

Powered by blists - more mailing lists

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.