Upgrade malojaserver to version 3.2.2 or higher.

org.opensaml:opensaml@2.6.1 vulnerabilities

latest version

2.6.4

first published

16 years ago

latest version published

9 years ago

licenses detected

Apache-2.0
[1.1,)

package manager

View on Maven Repository

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.opensaml:opensaml package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Fix for free

Vulnerability Vulnerable Version

Vulnerability	Vulnerable Version
M Improper Certificate Validation org.opensaml:opensaml provides tools to support developers working with the Security Assertion Markup Language (SAML). Affected versions of this package are vulnerable to Improper Certificate Validation. `HttpResource` and `FileBackedHttpResource` implementations in OpenSAML Java and Shibboleth IdP did not enable hostname verification when using TLS connections. Additionaly, OpenSAML Java makes use of Jakarta Commons HttpClient version 3.x, which does not perform verification of the server hostname against the server's X.508 certificate (CVE-2012-5783). This flaw can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject. How to fix Improper Certificate Validation? Upgrade `org.opensaml:opensaml` to version 2.6.2 or higher.	[2.0.0,2.6.2)
M Improper Certificate Validation `org.opensaml:opensaml` The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.	[,2.6.5)

Improper Certificate Validation

org.opensaml:opensaml provides tools to support developers working with the Security Assertion Markup Language (SAML).

Affected versions of this package are vulnerable to Improper Certificate Validation. HttpResource and FileBackedHttpResource implementations in OpenSAML Java and Shibboleth IdP did not enable hostname verification when using TLS connections. Additionaly, OpenSAML Java makes use of Jakarta Commons HttpClient version 3.x, which does not perform verification of the server hostname against the server's X.508 certificate (CVE-2012-5783). This flaw can be exploited by a Man-in-the-middle (MITM) attack, where the attacker can spoof a valid certificate using a specially crafted subject.

How to fix Improper Certificate Validation?

Upgrade org.opensaml:opensaml to version 2.6.2 or higher.

[2.0.0,2.6.2)

Improper Certificate Validation

org.opensaml:opensaml The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

[,2.6.5)

Go back to all versions of this package