[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <20151114173406.7e5b2be9@pc1>
Date: Sat, 14 Nov 2015 17:34:06 +0100
From: Hanno Böck <hanno@...eck.de>
To: oss-security@...ts.openwall.com
Subject: Re: New security advisory for Apache CXF
On Sat, 14 Nov 2015 15:32:32 +0000
Colm O hEigeartaigh <coheigea@...che.org> wrote:
> A new security advisory has been released for Apache CXF:
>
> CVE-2015-5253
> <http://cxf.apache.org/security-advisories.data/CVE-2015-5253.txt.asc?version=1&modificationDate=1447433340000&api=v2>:
> Apache CXF SAML SSO processing is vulnerable to a wrapping attack
It's a bit hard to judge from the description what this is about.
Am I right to assume that this is a fix for the XML encryption issues
Juraj Somorovsky found? He just presented that at BH Amsterdam
yesterday.
Every app that is using XML encryption in any way should be checked for
that.
(and the tl;dr is: don't decrypt unauthenticated data)
https://www.blackhat.com/eu-15/briefings.html#how-to-break-xml-encryption-automatically
--
Hanno Böck
http://hboeck.de/
mail/jabber: hanno@...eck.de
GPG: BBB51E42
Content of type "application/pgp-signature" skipped
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
