CVE-2015-1796: Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML
Summary
CVE-2015-1796: Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML. Affects org.opensaml:opensaml versions < 2.6.5. Fixed in 2.6.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Shibboleth Identity Provider is an open-source software package that provides Single Sign-On (SSO) capabilities for web applications. It is widely used in academic and research institutions to enable secure access to various online resources. OpenSAML Java (OpenSAML-J) is a library that implements the Security Assertion Markup Language (SAML) standard, which is used for exchanging authentication and authorization data between parties in a federated identity management system. Both Shibboleth Identity Provider and OpenSAML-J rely on the PKIX trust engines for certificate validation.
Vulnerability Detail
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML-J before 2.6.5 have an improper certificate validation vulnerability. When no trusted names are available for the entityID, these software packages trust candidate X.509 credentials, allowing remote attackers to impersonate an entity by presenting a certificate issued by a shibmd:KeyAuthority trust anchor. This vulnerability can be exploited to gain unauthorized access to protected resources and compromise the integrity and confidentiality of the system.
How To Fix
Minimum fixed version
2.6.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading to the patched versions of Shibboleth Identity Provider and OpenSAML-J.
Conclusion
The improper certificate validation vulnerability in Shibboleth Identity Provider and OpenSAML-J can have serious security implications, allowing attackers to impersonate entities and gain unauthorized access to protected resources. It is crucial to upgrade to the patched versions of these software packages to mitigate the risk. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.opensaml:opensaml →
FAQ
Shibboleth Identity Provider is an open-source software package that enables Single Sign-On (SSO) for web applications, commonly used in academic and research institutions.
OpenSAML Java (OpenSAML-J) is a library that implements the Security Assertion Markup Language (SAML) standard, used for exchanging authentication and authorization data in federated identity management systems.
The PKIX trust engine is a component used by Shibboleth Identity Provider and OpenSAML-J for validating X.509 certificates and establishing trust relationships between entities in a federated identity management system.
This vulnerability allows remote attackers to impersonate entities and gain unauthorized access to protected resources. It can lead to data breaches, unauthorized data disclosure, and compromise the integrity of the system.
To fix this vulnerability, upgrade to Shibboleth Identity Provider version 2.4.4 or later and OpenSAML-J version 2.6.5 or later. These versions include the necessary fixes for proper certificate validation.
Related vulnerabilities
Recent vulnerabilities recorded for org.opensaml:opensaml.
