CVE-2011-4314 — OpenID4Java does not verify that Attribute Exchange (AX) information is signed

Description

message/ax/AxMessage.java in OpenID4Java before 0.9.6 final, as used in JBoss Enterprise Application Platform 5.1 before 5.1.2, Step2, Kay Framework before 1.0.2, and possibly other products does not verify that Attribute Exchange (AX) information is signed, which allows remote attackers to modify potentially sensitive AX information without detection via a man-in-the-middle (MITM) attack.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 14	openid4java	0.9.6.662-1	—
Debian 13	openid4java	0.9.6.662-1	—
Debian 12	openid4java	0.9.6.662-1	—

Red Hat

Security tracker ↗

Release	Package	Fixed in	Advisory
Red Hat JBoss Web Platform 5	apache-cxf	2.2.12-4.patch_02.1.ep5.el6	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	cglib	2.2-5.3.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	facelets	1.1.15-3.B1_patch_01.2.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	glassfish-jaxb	2.1.12-10_patch_02.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	glassfish-jsf	1.2_13-5_patch_01.3.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jacorb-jboss	2.3.1-10.patch_03.4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jakarta-commons-logging-jboss	1.1-10.3_patch_02.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-aop2	2.1.6-2.CP03.1.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-cache-core	3.2.8-1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-cl	2.0.10-1.2.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-cluster-ha-client	1.1.4-1.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-common-core	2.2.18-1.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-eap5-native	5.1.2-1.4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-ejb3-core	1.3.8-0.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-ejb3-proxy-clustered	1.0.3-2.SP1.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-ejb3-proxy-impl	1.0.6-2.SP2.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-el	1.0_02-0.CR6.2.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-naming	5.0.3-3.CP01.3.ep5.el6	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-remoting	2.5.4-9.SP3.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-seam2 +3	2.2.5.EAP5-5.ep5.el5	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jboss-security-spi	1:2.0.4-6.SP8.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossas-web +2	5.1.2-7.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossas-web-tp-licenses	5.1.2-6.ep5.el6	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossas-ws-cxf-ewp	5.1.2-6.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbosssx2	2.0.4-6.SP8.2.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossts +1	1:4.6.1-11.CP12.4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossweb +4	2.1.12-1.4_patch_01.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossws	3.1.2-7.SP11.4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossws-common	1.1.0-6.SP8_patch_01.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossws-framework	3.1.2-6.SP10.1.ep5.el6	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jbossws-spi	1.1.2-5.SP7.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jgroups	1:2.6.20-1.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jopr-embedded	1.3.4-18.SP5.8.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jopr-jboss-as-5-plugin	3.0.0-12.EmbJopr4.ep5.el5	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	jopr-jboss-cache-v3-plugin	3.0.0-14.EmbJopr4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	mod_cluster +5	1.0.10-3.GA_CP02.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	org-mc4j-ems	1.2.15.1-4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	picketlink-federation +3	2.0.2-1.ep5.el6	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	resteasy +3	1.2.1-9.CP02.4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	rh-ewp-docs +1	5.1.2-4.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	rhq +15	3.0.0-20.EmbJopr4.ep5.el5	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	rhq-helpers +8	3.0.0-20.EmbJopr4.ep5.el6	RHSA-2011:1802
Red Hat JBoss Web Platform 5	rhq-platform-plugin +1	3.0.0-13.EmbJopr4.ep5.el5	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	slf4j	1.5.8-10_patch_01.2.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss Web Platform 5	xalan-j2	2.7.1-6_patch_05.1.ep5.el4	RHSA-2011:1804, RHSA-2011:1803, RHSA-2011:1802
Red Hat JBoss EAP 5	apache-cxf	2.2.12-4.patch_02.1.ep5.el6	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	cglib	2.2-5.3.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	facelets	1.1.15-3.B1_patch_01.2.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	glassfish-jaxb	2.1.12-10_patch_02.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	glassfish-jsf	1.2_13-5_patch_01.3.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jacorb-jboss	2.3.1-10.patch_03.4.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jakarta-commons-logging-jboss	1.1-10.3_patch_02.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-aop2	2.1.6-2.CP03.1.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-cache-core	3.2.8-1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-cl	2.0.10-1.2.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-cluster-ha-client	1.1.4-1.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-common-core	2.2.18-1.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-eap5-native	5.1.2-1.4.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-ejb3-core	1.3.8-0.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-ejb3-proxy-clustered	1.0.3-2.SP1.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-ejb3-proxy-impl	1.0.6-2.SP2.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-el	1.0_02-0.CR6.2.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-messaging	1.4.8-9.SP5.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-naming	5.0.3-3.CP01.3.ep5.el6	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-remoting	2.5.4-9.SP3.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-seam2 +3	2.2.5.EAP5-5.ep5.el5	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jboss-security-spi	1:2.0.4-6.SP8.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossas +4	5.1.2-8.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossas-tp-licenses	5.1.2-7.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbosssx2	2.0.4-6.SP8.2.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossts +1	1:4.6.1-11.CP12.4.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossweb +4	2.1.12-1.4_patch_01.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossws	3.1.2-7.SP11.4.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossws-common	1.1.0-6.SP8_patch_01.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossws-framework	3.1.2-6.SP10.1.ep5.el6	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jbossws-spi	1.1.2-5.SP7.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jgroups	1:2.6.20-1.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jopr-embedded	1.3.4-18.SP5.8.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jopr-jboss-as-5-plugin	3.0.0-12.EmbJopr4.ep5.el5	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	jopr-jboss-cache-v3-plugin	3.0.0-14.EmbJopr4.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	mod_cluster +5	1.0.10-3.GA_CP02.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	org-mc4j-ems	1.2.15.1-4.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	picketlink-federation +3	2.0.2-1.ep5.el6	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	resteasy +3	1.2.1-9.CP02.4.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	rh-eap-docs +1	5.1.2-6.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	rhq +24	3.0.0-20.EmbJopr4.ep5.el5	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	rhq-platform-plugin +1	3.0.0-13.EmbJopr4.ep5.el5	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	slf4j	1.5.8-10_patch_01.2.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798
Red Hat JBoss EAP 5	xalan-j2	2.7.1-6_patch_05.1.ep5.el4	RHSA-2011:1800, RHSA-2011:1799, RHSA-2011:1798

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	org.openid4java:openid4java	< 0.9.6	0.9.6	GHSA-j473-c3rr-rx9p

Advisories 6

RHSA-2011:1804 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:1802 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:1803 Red Hat Security Advisory: JBoss Enterprise Web Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:1800 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:1798 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026
RHSA-2011:1799 Red Hat Security Advisory: JBoss Enterprise Application Platform 5.1.2 update Red Hat Security Advisories (RHSA) · Aug 5, 2026

References

RHSA-2011:1804 vendor-advisory
44496 third-party-advisory
http://openid.net/2011/05/05/attribute-exchange-security-alert/
RHSA-2012:0519 vendor-advisory
48954 third-party-advisory
RHSA-2012:0441 vendor-advisory
[oss-security] 20111116 CVE Request: openid4java not properly verifying the signature of Attribute Exchange (AX) information mailing-list
https://issues.jboss.org/browse/SOA-3597
https://issues.jboss.org/browse/JBEPP-1368
1026400 vdb-entry
[oss-security] 20111116 Re: CVE Request: openid4java not properly verifying the signature of Attribute Exchange (AX) information mailing-list
48697 third-party-advisory