What is GHSA-qwwj-qj3f-9hv7?

GHSA-qwwj-qj3f-9hv7 is a security advisory published by GitHub Security Advisories with Medium severity. Improper Authentication in OpenSAML

Which CVE IDs does GHSA-qwwj-qj3f-9hv7 cover?

GHSA-qwwj-qj3f-9hv7 covers the following CVE IDs: CVE-2011-1411. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

Which products are affected by GHSA-qwwj-qj3f-9hv7?

GHSA-qwwj-qj3f-9hv7 affects 2 products, including: maven/org.opensaml:opensaml:\u003e= 2.4.0, \u003c 2.4.3; maven/org.opensaml:opensaml:\u003e= 2.5.0, \u003c 2.5.1.

GHSA-qwwj-qj3f-9hv7Medium

Improper Authentication in OpenSAML

Vendor

GitHub Security Advisories

Published

May 17, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2011-1411 →

📋 Description

Shibboleth OpenSAML library 2.4.x before 2.4.3 and 2.5.x before 2.5.1, and IdP before 2.3.2, allows remote attackers to forge messages and bypass authentication via an "XML Signature wrapping attack."

🎯 Affected products2

maven/org.opensaml:opensaml:>= 2.4.0, < 2.4.3
maven/org.opensaml:opensaml:>= 2.5.0, < 2.5.1

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2011-1411
http://shibboleth.internet2.edu/secadv/secadv_20110725.txt
http://www.debian.org/security/2011/dsa-2284
http://www.oracle.com/technetwork/topics/security/cpuoct2012-1515893.html
https://github.com/advisories/GHSA-qwwj-qj3f-9hv7