GHSA-qwwj-qj3f-9hv7
Improper Authentication in OpenSAML
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2011-1411
Description
Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."
Paquets affectés
| Paquet | Versions |
|---|---|
| Maven · org.opensaml:opensaml | introduced 2.4.0, fixed 2.4.3 |
| Maven · org.opensaml:opensaml | introduced 2.5.0, fixed 2.5.1 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2011-1411 ADVISORY
- http://shibboleth.internet2.edu/secadv/secadv_20110725.txt WEB
- http://www.debian.org/security/2011/dsa-2284 WEB
- http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |