Описание
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Отчет
This issue did not affect the versions of OpenSAML Java as shipped with Red Hat JBoss Data Virtualization 6, Red Hat JBoss Data Grid 6, Red Hat JBoss Enterprise Application Platform 5 and 6, Red Hat JBoss JBoss Operations Network 3, and Red Hat JBoss Portal 6. These products use a version of Jakarta Commons HttpClient that contains a fix for CVE-2012-5783. Fuse ESB 4 and Fuse Services Framework 2.3 and 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat JBoss Data Grid 6 | opensaml-java | Not affected | ||
| Red Hat JBoss Data Virtualization 6 | opensaml | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 5 | opensaml | Not affected | ||
| Red Hat JBoss Enterprise Application Platform 6 | opensaml | Not affected | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse-6 | Not affected | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse-esb-4 | Will not fix | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse-esb-7 | Not affected | ||
| Red Hat JBoss Enterprise Web Server 1 | fuse-sf-2 | Will not fix | ||
| Red Hat JBoss Operations Network 3 | opensaml | Not affected | ||
| Red Hat JBoss Portal 5 | opensaml | Will not fix |
Показывать по
Дополнительная информация
Статус:
EPSS
5.8 Medium
CVSS2
Связанные уязвимости
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
The (1) HttpResource and (2) FileBackedHttpResource implementations in ...
Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java
EPSS
5.8 Medium
CVSS2