Fedora alert FEDORA-2016-5cf6959198 (mod_auth_mellon)
| From: | updates@fedoraproject.org | |
| To: | package-announce@lists.fedoraproject.org | |
| Subject: | [SECURITY] Fedora 23 Update: mod_auth_mellon-0.11.1-1.fc23 | |
| Date: | Sun, 20 Mar 2016 02:32:35 +0000 (UTC) | |
| Message-ID: | <20160320023235.B98FF60A5EFB@bastion01.phx2.fedoraproject.org> |
-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2016-5cf6959198 2016-03-19 22:17:41.316290 -------------------------------------------------------------------------------- Name : mod_auth_mellon Product : Fedora 23 Version : 0.11.1 Release : 1.fc23 URL : https://github.com/UNINETT/mod_auth_mellon Summary : A SAML 2.0 authentication module for the Apache Httpd Server Description : The mod_auth_mellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server. -------------------------------------------------------------------------------- Update Information: [CVE-2016-2145] Fix DOS attack (Apache worker process crash) due to incorrect error handling when reading POST data from client. [CVE-2016-2146] Fix DOS attack (Apache worker process crash resource exhaustion) due to missing size checks when reading POST data. -------------------------------------------------------------------------------- References: [ 1 ] Bug #1315747 - CVE-2016-2146 mod_auth_mellon: Failure to limit amount of POST data submitted by client https://bugzilla.redhat.com/show_bug.cgi?id=1315747 [ 2 ] Bug #1315739 - CVE-2016-2145 mod_auth_mellon: Missing error check when calling ap_get_client_block() https://bugzilla.redhat.com/show_bug.cgi?id=1315739 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update mod_auth_mellon' at the command line. For more information, refer to "Managing Software with yum", available at https://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list package-announce@lists.fedoraproject.org https://admin.fedoraproject.org/mailman/listinfo/package-...