Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

🗓️ 17 May 2022 03:38:17Reported by GitHub Advisory DatabaseType

Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML. PKIX trust engines trust candidate X.509 credentials when no trusted names are available for the entityID

Reporter	Title	Published	Views	Family All 21
IBM Security Bulletins	Security Bulletin: IBM Tivoli Netcool Impact is affected by open source vulnerabilities	18 Jul 201809:46	–	ibm
IBM Security Bulletins	Security Bulletin: Common vulnerabilities fixed in Cloudera Data Platform 7.1.9 HF2	7 May 202419:52	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Resilient SOAR is using opensaml-2.6.4.jar that could be vulnerable to bypass security restrictions (CVE-2015-1796)	25 Feb 202114:37	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Data Risk Manager is affected by multiple vulnerabilities including a remote code execution in Spring Framework (CVE-2022-22965)	11 Apr 202215:17	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities identified in IBM StoredIQ	20 Feb 202012:42	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct Web Services is uses xmltooling-1.4.4.jar, which contains a vulnerability	25 Oct 202406:46	–	ibm
CNVD	Multiple Shibboleth Product Security Bypass Vulnerabilities	8 Jul 201500:00	–	cnvd
CVE	CVE-2015-1796	8 Jul 201515:00	–	cve
Cvelist	CVE-2015-1796	8 Jul 201515:00	–	cvelist
EUVD	EUVD-2022-2952	3 Oct 202520:07	–	euvd

Vulners

Node

edu.internet2.middleware shibboleth-identityproviderRange≤2.4.3maven

org.opensaml opensamlRange≤2.6.4maven

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2015-1796
shibboleth	www.shibboleth.net/community/advisories/secadv_20150225.txt
rhn	www.rhn.redhat.com/errata/RHSA-2015-1176.html
rhn	www.rhn.redhat.com/errata/RHSA-2015-1177.html
github	www.github.com/advisories/GHSA-78fq-w796-q537

27 Jan 2023 05:02Current

8.4High risk

Vulners AI Score8.4

CVSS 24.3

EPSS0.00166

CWE-295