keycloak, python2 security update

CentOS Errata and Security Advisory CESA-2019:2137 An update for keycloak-httpd-client-install is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2015-9287

Directory Traversal was discovered in University of Cambridge moducamwebauth before 2.0.2. The key identification field "kid" of the IdP's HTTP response message "WLS-Response" can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is...

Important: Red Hat Security Advisory: mod_auth_mellon security update

An update for modauthmellon is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Fedora Update for mod_auth_mellon FEDORA-2019-db1e9b3002

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

[SECURITY] Fedora 30 Update: mod_auth_mellon-0.14.2-1.fc30

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

CVE-2014-3603

The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2014-3603

The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

[SECURITY] Fedora 29 Update: mod_auth_mellon-0.14.0-5.fc29

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

F5 Networks BIG-IP : BIG-IP APM SAML IdP vulnerability (K05018525)

APMD may core when processing SAML Assertion or response containing certain elements.CVE-2018-5549 Impact This vulnerability allows a disruption of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution...

SAML Signature Wrapping

samlify is vulnerable to signature wrapping. An attacker is able wrap the signature of a SAML response and insert a new username in the original SAML token received from IdP before validating with the service provider. This allow the attacker to forge a token and impersonate as another user...

CVE-2018-12175

Intel Distribution for Python 2018 is affected by CVE-2018-12175 due to default install directory permissions that could allow an unprivileged local user to escalate privileges. Affected product: IDP 2018 (pre Update 3). Root cause: insecure default install permissions enabling privilege escalati...

RHEL 7 : Red Hat JBoss Enterprise Application Platform (RHSA-2015:1671)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1671 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a...

GHSA-CQ94-QF6Q-MF2H Pysaml2 improperly initializes encryption vector

Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

Pysaml2 improperly initializes encryption vector

Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...

Insufficient Input Validation in Bleach module in Intel® Distribution for Python (IDP) version IDP 2018 Update 2 potentially allows an unprivileged user to bypass URI sanitization and cause a Denial of Service via local vector

Summary: Insufficient Input Validation in Bleach module in Intel® Distribution for Python IDP version IDP 2018 Update 2 potentially allows an unprivileged user to bypass URI sanitization and cause a Denial of Service via local vector. Description: A vulnerable version of the Mozilla Bleach librar...

idp.plusretail.nl Open Redirect vulnerability

Open Bug Bounty ID: OBB-633861 Description| Value ---|--- Affected Website:| idp.plusretail.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

idp.suisseid-idp.ch Open Redirect vulnerability

Open Bug Bounty ID: OBB-633849 Description| Value ---|--- Affected Website:| idp.suisseid-idp.ch Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

login.good.com Open Redirect vulnerability

Open Bug Bounty ID: OBB-633823 Description| Value ---|--- Affected Website:| login.good.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| Open Redirect / CWE-601 CVSSv3 Score:| 3.4...

Juniper Junos IDP Policy Compilation Packet Handling Firewall Rule Bypass Remote Information Disclosure (JSA10846)

According to its self-reported version number, the remote Junos device is affected by an information disclosure vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid109212; scriptversion"1.6"; scriptsetattributeattribute:"pluginmodificationdate",...

CVE-2018-0229

A vulnerability in the implementation of Security Assertion Markup Language SAML Single Sign-On SSO authentication for Cisco AnyConnect Secure Mobility Client for Desktop Platforms, Cisco Adaptive Security Appliance ASA Software, and Cisco Firepower Threat Defense FTD Software could allow an...