Description

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

Remediation

References

http://rhn.redhat.com/errata/RHSA-2015-1176.html

http://rhn.redhat.com/errata/RHSA-2015-1177.html

http://www.securityfocus.com/bid/75370

https://shibboleth.net/community/advisories/secadv_20150225.txt

Related Vulnerabilities

CVE-2021-21172 Vulnerability in maven package org.webjars.npm:electron

CVE-2009-2902 Vulnerability in maven package org.apache.tomcat:catalina

CVE-2020-24591 Vulnerability in maven package org.wso2.carbon.analytics-common:org.wso2.carbon.event.receiver.core

CVE-2023-45134 Vulnerability in maven package org.xwiki.platform:xwiki-platform-web-templates

CVE-2018-8027 Vulnerability in maven package org.apache.camel:camel-core

Severity

Critical

Classification

CWE-254

Tags

Vendor Advisory