CVE-2014-3603: Medium severity shibboleth vulnerability
It was discovered that HttpResource and FileBackedHttpResource implementations in OpenSAML Java and Shibboleth IdP did not enable hostname verification when using TLS connections. Additionaly, OpenSAML Java makes use of Jakarta Commons HttpClient version 3.x, which does not perform verification of the server hostname against the server's X.508 certificate (CVE-2012-5783). This flaw can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.
Other sources
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3603?
CVE-2014-3603 has been classified as a medium severity vulnerability due to its potential impact on secure TLS communications.
How do I fix CVE-2014-3603?
To fix CVE-2014-3603, upgrade the affected OpenSAML or Shibboleth IdP versions to the latest releases that implement hostname verification.
What types of systems are affected by CVE-2014-3603?
CVE-2014-3603 affects systems utilizing OpenSAML Java and Shibboleth Identity Provider versions prior to their respective patched releases.
What is the main risk associated with CVE-2014-3603?
The main risk associated with CVE-2014-3603 is the potential for man-in-the-middle attacks due to the lack of hostname verification during TLS connections.
Is there a specific version of OpenSAML affected by CVE-2014-3603?
Yes, OpenSAML Java versions prior to 2.6.2 are specifically affected by CVE-2014-3603.