edu.internet2.middleware:shibboleth-identityprovider

3 results · Clear filters · Feed

• Medium 5.9
  CVE-2014-3603

  Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java

  The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName fie…

  Shibboleth; OpenSAML Java OpenSAML Java Identity Provider (IdP) org.opensaml:opensaml Maven
  Apr 4, 2019
• Medium 5.9
  CVE-2014-3607

  Improper Certificate Validation in vt-ldap

  DefaultHostnameVerifier in Ldaptive (formerly vt-ldap) does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via …

  edu.internet2.middleware:shibboleth-identityprovider edu.vt.middleware:vt-ldap libvt-ldap-java Debian Maven
  Jan 8, 2018
• Medium —
  CVE-2015-1796

  Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

  The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via …

  org.opensaml:opensaml edu.internet2.middleware:shibboleth-identityprovider Maven
  Jul 8, 2015