GHSA-rm7v-gqfg-p2wc

Source

https://github.com/advisories/GHSA-rm7v-gqfg-p2wc

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-rm7v-gqfg-p2wc/GHSA-rm7v-gqfg-p2wc.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-rm7v-gqfg-p2wc

Aliases

CVE-2014-3603

Published

2022-05-14T01:11:29Z

Modified

2023-11-08T03:57:39.449550Z

Severity

5.9 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Summary

Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java

Details

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Database specific

{
    "nvd_published_at": "2019-04-04T14:29:00Z",
    "github_reviewed_at": "2022-07-07T22:38:37Z",
    "severity": "MODERATE",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-297"
    ]
}

References

Affected packages

Maven / edu.internet2.middleware:shibboleth-identityprovider

Package

Name: edu.internet2.middleware:shibboleth-identityprovider; View open source insights on deps.dev
Purl: pkg:maven/edu.internet2.middleware/shibboleth-identityprovider

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.1

Maven / org.opensaml:opensaml

Package

Name: org.opensaml:opensaml; View open source insights on deps.dev
Purl: pkg:maven/org.opensaml/opensaml

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.6.2

Affected versions

1.*

1.1

2.*

2.1.0

2.2.0

2.2.1

2.2.3

2.4.1

2.5.1

2.5.1-1

2.5.3

2.6.0

2.6.1