medium5.8
CVE-2011-1411
Improper Authentication in OpenSAML
Impact
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.opensaml:opensaml | >= 2.4.0, < 2.4.3 | 2.4.3 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Shibboleth | Opensaml | Versions 2.4.0, 2.4.1, 2.4.2, 2.5.0 |
| Shibboleth | Shibboleth-Identity-Provider | through 2.3.1 Versions 2.0.0, 2.1.0, 2.1.1, 2.1.2, 2.1.3 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- http://secunia.com/advisories/50994
- http://shibboleth.internet2.edu/secadv/secadv_20110725.txt
- http://www.debian.org/security/2011/dsa-2284
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:150
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
- https://github.com/advisories/GHSA-qwwj-qj3f-9hv7
- https://nvd.nist.gov/vuln/detail/CVE-2011-1411