CVE-2015-1796
Medium
Description
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
SeverityMedium
CVSS4.3
Exploit probability—
ProductShibboleth Identity Provider
PublishedJul 8, 2015
First seenJul 8, 2015
How to fix
Update
- org.opensaml:opensaml2.6.5 or later
- edu.internet2.middleware:shibboleth-identityprovider2.4.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| shibboleth identity_provider | v ≤ 2.4.3 | — |
| shibboleth opensaml_java | v ≤ 2.6.4 | — |
| org.opensaml:opensamlMaven | v < 2.6.5 | 2.6.5 |
| edu.internet2.middleware:shibboleth-identityproviderMaven | v < 2.4.4 | 2.4.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.