What is GHSA-rm7v-gqfg-p2wc?

GHSA-rm7v-gqfg-p2wc is a security advisory published by GitHub Security Advisories with Medium severity. Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java

Which CVE IDs does GHSA-rm7v-gqfg-p2wc cover?

GHSA-rm7v-gqfg-p2wc covers the following CVE IDs: CVE-2014-3603. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rm7v-gqfg-p2wc?

GHSA-rm7v-gqfg-p2wc has a CVSS v3 base score of 5.9, published by GitHub Security Advisories.

Which products are affected by GHSA-rm7v-gqfg-p2wc?

GHSA-rm7v-gqfg-p2wc affects 2 products, including: maven/edu.internet2.middleware:shibboleth-identityprovider:\u003c 2.4.1; maven/org.opensaml:opensaml:\u003c 2.6.2.

GHSA-rm7v-gqfg-p2wcMediumCVSS 5.9

Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java

Vendor

GitHub Security Advisories

Published

May 14, 2022

Last Modified

January 27, 2023

🔗 CVE IDs covered (1)

CVE-2014-3603 →

📋 Description

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

🎯 Affected products2

maven/edu.internet2.middleware:shibboleth-identityprovider:< 2.4.1
maven/org.opensaml:opensaml:< 2.6.2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2014-3603
https://bugzilla.redhat.com/show_bug.cgi?id=1131823
http://shibboleth.net/community/advisories/secadv_20140813.txt
https://github.com/advisories/GHSA-rm7v-gqfg-p2wc