CVE:CVE-2019-3877
CNNVD:CNNVD-201903-896
mod_auth_mellon是一款使用在Apache中的身份验证模块。
mod_auth_mellon中存在安全漏洞，该漏洞源于程序会将接收到的带有斜杠的请求认定为相对URL，而浏览器则会将其认定为绝对URL并将斜杠字符转换成正斜杠。攻击者可利用该漏洞绕过重定向URL逻辑。
solution:Upgrade mod_auth_mellon_project mod_auth_mellon to a higher version than 0.14.2,and avoid the version (,0.14.2); Upgrade fedoraproject fedora to a higher version than 29,and avoid the version 29; Upgrade redhat enterprise_linux to a higher version than 7.0,and avoid the version 7.0; Upgrade canonical ubuntu_linux to a higher version than 18.04,18.10,and avoid the version 18.04,18.10