CVE-2015-1796: Medium severity shibboleth Identity Provider vulnerability
A critical flaw has been discovered in the PKIX trust components that allows an X509 credential to be trusted in the special case where no trusted names are available for the given entityID. See External References for the complete details.
External References:
http://shibboleth.net/community/advisories/secadv20150225.txt
Other sources
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1796?
CVE-2015-1796 has been classified as having a medium severity level.
How do I fix CVE-2015-1796?
To fix CVE-2015-1796, upgrade Shibboleth Identity Provider to version 2.4.4 or later and OpenSAML Java to version 2.6.5 or later.
What types of attacks does CVE-2015-1796 enable?
CVE-2015-1796 enables attackers to impersonate an entity via the exploitation of improperly trusted X.509 credentials.
Which versions are affected by CVE-2015-1796?
CVE-2015-1796 affects Shibboleth Identity Provider versions prior to 2.4.4 and OpenSAML Java versions prior to 2.6.5.
What components are involved in CVE-2015-1796?
CVE-2015-1796 involves the PKIX trust engines in both the Shibboleth Identity Provider and OpenSAML Java.