GHSA-qwwj-qj3f-9hv7

Improper Authentication in OpenSAML

At a glance

Published: 2022-05-17 05:02 UTC
Updated: 2024-12-07 05:39 UTC
CVE: CVE-2011-1411

Description

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

Affected packages

Package	Versions
Maven · org.opensaml:opensaml	introduced 2.4.0, fixed 2.4.3
Maven · org.opensaml:opensaml	introduced 2.5.0, fixed 2.5.1

References

https://nvd.nist.gov/vuln/detail/CVE-2011-1411 ADVISORY
http://shibboleth.internet2.edu/secadv/secadv_20110725.txt WEB
http://www.debian.org/security/2011/dsa-2284 WEB
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database