Description

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

Remediation

References

http://secunia.com/advisories/50994

http://shibboleth.internet2.edu/secadv/secadv_20110725.txt

http://www.debian.org/security/2011/dsa-2284

http://www.mandriva.com/security/advisories?name=MDVSA-2013:150

http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html

Related Vulnerabilities

CVE-2022-41704 Vulnerability in maven package org.apache.xmlgraphics:batik-bridge

CVE-2018-1000136 Vulnerability in npm package electron

CVE-2022-41254 Vulnerability in maven package org.jenkins-ci.plugins:cons3rt

CVE-2020-26883 Vulnerability in maven package com.typesafe.play:play-java

CVE-2020-2125 Vulnerability in maven package ru.yandex.jenkins.plugins.debuilder:debian-package-builder

Severity

Critical

Tags

Vendor Advisory CWE-287