[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20150323174404.BDA286C0023@smtpvmsrv1.mitre.org>
Date: Mon, 23 Mar 2015 13:44:04 -0400 (EDT)
From: cve-assign@...re.org
To: corsac@...ian.org
Cc: cve-assign@...re.org, oss-security@...ts.openwall.com, team@...urity.debian.org
Subject: Re: CVE requests for shibboleth service provider
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
> https://shibboleth.net/community/advisories/secadv_20150319.txt
>
> The SP software contains an authenticated denial of service
> vulnerability that results in a crash on certain kinds of malformed
> SAML messages. The vulnerability is only triggered when special
> conditions are met and after a message or assertion signature
> has been verified, so exploitation requires a message produced
> under a trusted key
> Recommendations
> -----------------
> Update to V2.5.4 or later of the Shibboleth SP software
Use CVE-2015-2684 for this Shibboleth Service Provider issue. The
vendor's secadv_20150319.txt advisory is about this CVE in addition to
unrelated CVEs in two third-party components (Xerces-C and OpenSSL).
> https://issues.shibboleth.net/jira/issues/?filter=10771
We currently don't know whether CVE-2015-2684 is one of the above 24
issues on the "Shibboleth 2 SP 2.5.4 Fixes" list, or whether the
CVE-2015-2684 fix is separate from all of those.
- --
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)
iQEcBAEBAgAGBQJVEFBmAAoJEKllVAevmvmsbCEH/2jB7DlY+p1/vTpCMHe3iTXk
HvSfm4Qkq89GmXiChEbGyWY0p4FztSIvX679SWZbgNjnr0RcGQ4HziP9AjV2+7n/
2FxfN/sATcIyTZpQM78S2g9oP5AUFV3WlO1U5cod+SzNYWAVgfcb3hyAHqp7ftzf
epWlNlLyW2ZPnhYJHXVF67kUGcLWab0PZINKtH1Z5x7ANIFzXkDNCiZqI2EFOFtg
m03OKQHCzZUZghOvbWeSic/VfXUwuG5yxzEwixce/euBdUF0b9miwnJy6fEfOwbH
7eRlTBaMRpf9+IVk9UVo+1JCtIUzq3Ww+9ULP1qhxX93FilRATD68DNWvILb2Mg=
=lPwL
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
