CVSS: 8.1EPSS: 1%CPEs: 3EXPL: 0CVE-2017-16853
https://notcve.org/view.php?id=CVE-2017-16853
The DynamicMetadataProvider class in saml/saml2/metadata/impl/DynamicMetadataProvider.cpp in OpenSAML-C in OpenSAML before 2.6.1 fails to properly configure itself with the MetadataFilter plugins and does not perform critical security checks such as signature verification, enforcement of validity periods, and other checks specific to deployments, aka CPPOST-105. La clase DynamicMetadataProvider en saml/saml2/metadata/impl/DynamicMetadataProvider.cpp en OpenSAML-C en OpenSAML, en versiones anteriores a la 2.6.1, no se configura correctamente con los plugins MetadataFilter y no realiza las verificaciones de seguridad críticas como la verificación de firmas, cumplimiento de los periodos de validez y otras comprobaciones específicas de despliegues. Esta vulnerabilidad también se conoce como CPPOST-105. • http://www.securityfocus.com/bid/101898 https://bugs.debian.org/881856 https://git.shibboleth.net/view/?p=cpp-opensaml.git%3Ba=commit%3Bh=6182b0acf2df670e75423c2ed7afe6950ef11c9d https://lists.debian.org/debian-lts-announce/2017/11/msg00024.html https://shibboleth.net/community/advisories/secadv_20171115.txt https://www.debian.org/security/2017/dsa-4039 • CWE-347: Improper Verification of Cryptographic Signature •
CVSS: 5.0EPSS: 0%CPEs: 12EXPL: 0CVE-2013-6440 – Java: XML eXternal Entity (XXE) flaw in ParserPool and Decrypter
https://notcve.org/view.php?id=CVE-2013-6440
The (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter, and (4) SAML Decrypter in Shibboleth OpenSAML-Java before 2.6.1 set the expandEntityReferences property to true, which allows remote attackers to conduct XML external entity (XXE) attacks via a crafted XML DOCTYPE declaration. (1) BasicParserPool, (2) StaticBasicParserPool, (3) XML Decrypter y (4) SAML Decrypter en Shibboleth OpenSAML-Java anterior a 2.6.1 establece la propiedad expandEntityReferences como "true", lo que permite a atacantes remotos realizar ataques de entidad externa XML (XXE) a través de una declaración XML DOCTYPE manipulada. It was found that the ParserPool and Decrypter classes in the OpenSAML Java implementation resolved external entities, permitting XML External Entity (XXE) attacks. A remote attacker could use this flaw to read files accessible to the user running the application server, and potentially perform other more advanced XXE attacks. • http://blog.sendsafely.com/post/69590974866/web-based-single-sign-on-and-the-dangers-of-saml-xml http://rhn.redhat.com/errata/RHSA-2014-0170.html http://rhn.redhat.com/errata/RHSA-2014-0171.html http://rhn.redhat.com/errata/RHSA-2014-0172.html http://rhn.redhat.com/errata/RHSA-2014-0195.html http://shibboleth.net/community/advisories/secadv_20131213.txt https://bugzilla.redhat.com/show_bug.cgi?id=1043332 https://www.oracle.com/security-alerts/cpujan2022.html https://access • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 7.5EPSS: 0%CPEs: 14EXPL: 0CVE-2009-3474
https://notcve.org/view.php?id=CVE-2009-3474
OpenSAML 2.x before 2.2.1 and XMLTooling 1.x before 1.2.1, as used by Internet2 Shibboleth Service Provider 2.x before 2.2.1, do not follow the KeyDescriptor element's Use attribute, which allows remote attackers to use a certificate for both signing and encryption when it is designated for just one purpose, potentially weakening the intended security application of the certificate. OpenSAML v2.x anterior a v2.2.1 y XMLTooling v1.x anterior a v1.2.1, utilizado por Internet2 Shibboleth Service Provider v2.x anterior a v2.2.1,no siguen el atributo Use del elemento KeyDescriptor, lo cual permite a atacantes remotos utilizar un certificado para la firma y encriptación, cuando esta designado para un solo fin, debilitando potencialmente el propósito de aplicación de seguridad del certificado. • http://secunia.com/advisories/36855 http://secunia.com/advisories/36868 http://secunia.com/advisories/36876 http://shibboleth.internet2.edu/secadv/secadv_20090817a.txt http://www.debian.org/security/2009/dsa-1895 http://www.debian.org/security/2009/dsa-1896 http://www.securityfocus.com/bid/36516 https://bugs.internet2.edu/jira/browse/CPPOST-28 https://exchange.xforce.ibmcloud.com/vulnerabilities/53474 • CWE-310: Cryptographic Issues •