[SECURITY] Fedora 30 Update: mod_auth_mellon-0.15.0-1.fc30

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

[SECURITY] Fedora 31 Update: mod_auth_mellon-0.15.0-1.fc31

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

Disabling SAML override in Confluence Data Center doesn't work

h3. Issue Summary Disabling SAML override in Confluence DC, to ensure no users can log in to Confluence via SAML/SSO only, still allows users to use default login URL and access the instance with local credentials. h3. Steps to Reproduce Configure Confluence DC with SAML/SSO steps not covered her...

Moderate: Red Hat Security Advisory: mod_auth_mellon security, bug fix, and enhancement update

An update for modauthmellon is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

keycloak, python2 security update

CentOS Errata and Security Advisory CESA-2019:2137 An update for keycloak-httpd-client-install is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System CVSS base score, which gives a...

CVE-2015-9287

Directory Traversal was discovered in University of Cambridge moducamwebauth before 2.0.2. The key identification field "kid" of the IdP's HTTP response message "WLS-Response" can be manipulated by an attacker. The "kid" field is not signed like the rest of the message, and manipulation is...

Important: Red Hat Security Advisory: mod_auth_mellon security update

An update for modauthmellon is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability...

Fedora Update for mod_auth_mellon FEDORA-2019-db1e9b3002

The remote host is missing an update for the Copyright C 2019 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

allianceauth (>=2.1.0 <=2.1.1), beanstalk-dispatch (>=0.0.3 <=0.0.5) +214 more potentially affected by CVE-2019-11358 via django (>=2.0.0 <=2.1.8)

django PYPI version =2.0.0, =2.1.0, =0.0.3, =0.1.0, =0.1.0, =0.5.0, =3.0.0, =2.1.0, =0.0.1, =1.1.0, =1.2.1 and more Source cves: CVE-2019-11358 Source advisory: OSV:GHSA-6C3J-C64M-QHGQ...

[SECURITY] Fedora 30 Update: mod_auth_mellon-0.14.2-1.fc30

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

CVE-2014-3603

The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

CVE-2014-3603

The 1 HttpResource and 2 FileBackedHttpResource implementations in Shibboleth Identity Provider IdP before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name CN or subjectAltName field of the X.509 certificate, which allows...

[SECURITY] Fedora 29 Update: mod_auth_mellon-0.14.0-5.fc29

The modauthmellon module is an authentication service that implements the SAML 2.0 federation protocol. It grants access based on the attributes received in assertions generated by a IdP server...

F5 Networks BIG-IP : BIG-IP APM SAML IdP vulnerability (K05018525)

APMD may core when processing SAML Assertion or response containing certain elements.CVE-2018-5549 Impact This vulnerability allows a disruption of service. C Tenable Network Security, Inc. The descriptive text and package checks in this plugin were extracted from F5 Networks BIG-IP Solution...

SAML Signature Wrapping

samlify is vulnerable to signature wrapping. An attacker is able wrap the signature of a SAML response and insert a new username in the original SAML token received from IdP before validating with the service provider. This allow the attacker to forge a token and impersonate as another user...

org.apache.cxf.fediz:apache-fediz (=1.2.0) potentially affected by CVE-2015-5175 via org.apache.cxf.fediz:fediz-idp (=1.2.0)

org.apache.cxf.fediz:fediz-idp MAVEN version =1.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf.fediz:fediz-idp and may be impacted: - org.apache.cxf.fediz:apache-fediz =1.2.0 Source cves: CVE-2015-5175 Source advisory:...

CVE-2018-12175

Intel Distribution for Python 2018 is affected by CVE-2018-12175 due to default install directory permissions that could allow an unprivileged local user to escalate privileges. Affected product: IDP 2018 (pre Update 3). Root cause: insecure default install permissions enabling privilege escalati...

RHEL 7 : Red Hat JBoss Enterprise Application Platform (RHSA-2015:1671)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2015:1671 advisory. Red Hat JBoss Enterprise Application Platform 6 is a platform for Java applications based on JBoss Application Server 7. This release serves as a...

beanstalk-dispatch (>=0.0.3 <=0.0.5), cklauth (>=0.1.0 <=0.3.0) +132 more potentially affected by CVE-2018-14574 via django (>=2.0.0 <=2.0.7)

django PYPI version =2.0.0, =0.0.3, =0.1.0, =0.5.0, =3.0.0, =2.1.0, =0.0.1, =1.1.0, =0.0.7, =0.1.0, =0.0.2, =1.3.0, =2.0.0, =2.0.2 and more Source cves: CVE-2018-14574 Source advisory: OSV:PYSEC-2018-2...

GHSA-CQ94-QF6Q-MF2H Pysaml2 improperly initializes encryption vector

Python package pysaml2 version 4.5.0 and earlier reuses the initialization vector across encryptions in the IDP server, resulting in weak encryption of data...