CVE-2014-3603
First published: Wed Aug 20 2014(Updated: )
It was discovered that HttpResource and FileBackedHttpResource implementations in OpenSAML Java and Shibboleth IdP did not enable hostname verification when using TLS connections. Additionaly, OpenSAML Java makes use of Jakarta Commons HttpClient version 3.x, which does not perform verification of the server hostname against the server's X.508 certificate (<a href="https://access.redhat.com/security/cve/CVE-2012-5783">CVE-2012-5783</a>). This flaw can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/opensaml | <2.6.2 | 2.6.2 |
| Shibboleth Identity Provider | <2.4.1 | |
| Shibboleth Opensaml Java | <2.6.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://secunia.com/advisories/60816
- http://shibboleth.net/community/advisories/secadv_20140813.txt
- https://bugzilla.redhat.com/show_bug.cgi?id=1131823
- https://access.redhat.com/security/cve/CVE-2012-5783
- http://svn.shibboleth.net/view/java-opensaml2/branches/REL_2/src/main/java/org/opensaml/DefaultBootstrap.java?r1=1622&r2=1666&pathrev=1666
- https://access.redhat.com/support/policy/updates/fusesource/
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1132022
- https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3603.yaml
- collector/nvd-index
- agent/type
- agent/first-publish-date
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-3603
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/author
- agent/description
- agent/tags
- agent/event
- agent/trending
- vendor/shibboleth
- canonical/shibboleth identity provider
- canonical/shibboleth opensaml java
- package-manager/redhat