From 7d7c2271f6c957574221e8746e5a356435cd114f Mon Sep 17 00:00:00 2001 From: Palle Girgensohn Date: Thu, 23 Jul 2015 16:24:25 +0000 Subject: Shibboleth SP software crashes on well-formed but invalid XML. The Service Provider software contains a code path with an uncaught exception that can be triggered by an unauthenticated attacker by supplying well-formed but schema-invalid XML in the form of SAML metadata or SAML protocol messages. The result is a crash and so causes a denial of service. You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or later. The easiest way to do so is to update the whole chain including shibboleth-2.5.5 an opensaml2.5.5. URL: http://shibboleth.net/community/advisories/secadv_20150721.txt Security: CVE-2015-2684 Approved by: ports-secteam --- security/vuxml/vuln.xml | 48 ++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 48 insertions(+) diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index a8e86fe8585d..f521a94211c6 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -57,6 +57,54 @@ Notes: --> + + shibboleth-sp -- DoS vulnerability + + + xmltooling + 1.5.5 + + + opensaml2 + 2.5.5 + + + shibboleth-sp + 2.5.5 + + + + +

Shibboleth consortium reports:

+
+ Shibboleth SP software crashes on well-formed but invalid XML. +
+
+ The Service Provider software contains a code path with an uncaught + exception that can be triggered by an unauthenticated attacker by + supplying well-formed but schema-invalid XML in the form of SAML + metadata or SAML protocol messages. The result is a crash and so + causes a denial of service. +
+
+ You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or + later. The easiest way to do so is to update the whole chain including + shibboleth-2.5.5 an opensaml2.5.5. +
+

+ + + + http://shibboleth.net/community/advisories/secadv_20150721.txt + CVE-2015-2684 + + + 2015-07-21 + 2015-07-23 + + + subversion -- DoS vulnerabilities -- cgit v1.2.3