Описание
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| php-cas | fixed | 1.3.6-1 | package | |
| php-cas | no-dsa | stretch | package | |
| php-cas | no-dsa | jessie | package | |
| php-cas | no-dsa | wheezy | package |
Примечания
https://github.com/Jasig/phpCAS/issues/228
Fixed by: https://github.com/apereo/phpCAS/commit/c9ba00327fd0ac8faecc62ce150c1986022856cd
The vulnerability only exists when the server is affected by
another very old vulnerability fixed in 2010.
Связанные уязвимости
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.
Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.