CVE-2019-3878: canonical ubuntu_linux
Vulnerability summary
CVE-2019-3878 is a high (CVSS 8.1) vulnerability in canonical ubuntu_linux. EPSS estimates a 2.97% chance of exploitation in the next 30 days, higher than 87.2% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 26-03-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A vulnerability was found in mod_auth_mellon before v0.14.2. If Apache is configured as a reverse proxy and mod_auth_mellon is configured to only let through authenticated users (with the require valid-user directive), adding special HTTP headers that are normally used to start the special SAML ECP (non-browser based) can be used to bypass authentication.
CVSS metrics
6 scores · 5 sources · 2 versions- OSV · Red hatEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
- OSV · DebianEcosystem advisory · calculated8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST8.1HighCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
2.97%
Chance of exploitation in the next 30 days
Percentile
87%
Versus all other CVEs
30-day change
No change 0.00 pp
From 2.97% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMod Auth Mellon
Maturity: poc
Weaknesses
CWE · root cause- CWE-305Authentication Bypass by Primary WeaknessThe authentication algorithm is sound, but the implemented mechanism can be bypassed as the result of a separate weakness that is primary to the authentication error.
- CWE-287Improper AuthenticationWhen an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Affected systems
Known conditions: network-reachable, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat11 products
- enterprise_linuxEOL7.0
- enterprise_linux_desktop7.0
- enterprise_linux_server7.0
- enterprise_linux_server_aus7.6
- enterprise_linux_server_eus7.6
Canonical1 product
- ubuntu_linuxEOL18.04 | 18.10
Debian1 product
- libapache2-mod-auth-mellon< 0.14.2-1
Fedoraproject1 product
- fedoraEOL29 | 30
Mod_auth_mellon_project1 product
- mod_auth_mellon< 0.14.2
Ubuntu1 product
- libapache2-mod-auth-mellon< 0.12.0-2+deb9u1build0.16.04.1 | < 0.13.1-1ubuntu0.1 | < 0.14.2-1ubuntu1
Uninett1 product
- mod_auth_mellon< v0.14.2
7 vendors · 17 products
References
19 links- bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3878X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
- github.com/Uninett/mod_auth_mellon/pull/196X Refsource CONFIRMARTICLEREPORTExploitPatchThird Party Advisory
