CVE-2015-1796: Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

May 17, 2022 (updated July 6, 2022)

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

References

rhn.redhat.com/errata/RHSA-2015-1176.html
rhn.redhat.com/errata/RHSA-2015-1177.html
github.com/advisories/GHSA-78fq-w796-q537
nvd.nist.gov/vuln/detail/CVE-2015-1796
shibboleth.net/community/advisories/secadv_20150225.txt

Code Behaviors & Features

Detect and mitigate CVE-2015-1796 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →