PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

A flaw was found in the way PicketLink's Service Provider SP and Identity Provider IdP handled certain requests. The SP and IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in the SAML assertion matches the location from which the message was...

Important: Red Hat Security Advisory: Red Hat JBoss BRMS 6.1.0 update

Red Hat JBoss BRMS 6.1.0, which fixes multiple security issues, several bugs, and adds various enhancements, is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores,...

CXF: Improper security semantics enforcement of SAML SubjectConfirmation methods

It was found that Apache WSS4J Web Services Security for Java, as used by Apache CXF with the TransportBinding, did not, by default, properly enforce all security requirements associated with SAML SubjectConfirmation methods. A remote attacker could use this flaw to perform various types of...

PicketLink: SP does not take Audience condition of a SAML assertion into account

A flaw was found in the way PicketLink's Service Provider and Identity Provider handled certain requests. A remote attacker could use this flaw to log to a victim's account via PicketLink...

PicketLink: Lack of validation for the Destination attribute in a Response element in a SAML assertion

A flaw was found in the way PicketLink's Service Provider SP and Identity Provider IdP handled certain requests. The SP and IdP in PicketLink before 2.7.0 does not ensure that the Destination attribute in a Response element in the SAML assertion matches the location from which the message was...

MGASA-2015-0148 Updated shibboleth-sp packages fix CVE-2015-2684

Updated shibboleth-sp package fixes security vulnerability: A denial of service vulnerability was found in the Shibboleth Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash CVE-2015-2684...

Updated shibboleth-sp packages fix CVE-2015-2684

Updated shibboleth-sp package fixes security vulnerability: A denial of service vulnerability was found in the Shibboleth Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash CVE-2015-2684...

[BSA-103] Security Update for shibboleth-sp

Matthew Vernon uploaded new packages for shibboleth-sp which fixed the following security problems: CVE-2015-2684 A denial of service vulnerability was found in the Shibboleth a federated identity framework Service Provider. When processing certain malformed SAML messages generated by an...

[SECURITY] Fedora 21 Update: lasso-2.4.1-1.fc21

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

[SECURITY] Fedora 20 Update: lasso-2.4.1-1.fc20

Lasso is a library that implements the Liberty Alliance Single Sign On standards, including the SAML and SAML2 specifications. It allows to handle the whole life-cycle of SAML based Federations, and provides bindings for multiple languages...

CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

Code injection

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

UBUNTU-CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

CVE-2015-2684

Removed by vendor...

CVE-2015-2684

CVE-2015-2684 affects the Shibboleth Service Provider (SP) prior to version 2.5.4. It allows a remote authenticated attacker to cause a denial of service (crash) by sending crafted SAML messages; multiple sources confirm a fix involves upgrading/shifting to newer SP releases (e.g., 2.5.4+ and rel...

CVE-2015-2684: Improper Input Validation

Shibboleth Service Provider SP before 2.5.4 allows remote authenticated users to cause a denial of service crash via a crafted SAML message...

KLA10521 Denial of service vulnerability in Shibboleth SP

An unspecified vulnerability was found in Shibboleth SP. By exploiting this vulnerability malicious users can cause denial of service. This vulnerability can be exploited remotely via a specially designed SAML message. Original advisories Shibboleth advisory Exploitation Related products...

Debian Security Advisory DSA 3207-1 (shibboleth-sp2 - security update)

A denial of service vulnerability was found in the Shibboleth an federated identity framework Service Provider. When processing certain malformed SAML message generated by an authenticated attacker, the daemon could crash. OpenVAS Vulnerability Test $Id: deb3207.nasl 6609 2017-07-07 12:05:59Z...