Description
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 7 | zendframework | 1.11.13-1.1+deb7u1 | DSA-3265-1 |
| Debian 6.0 | zendframework | 1.10.6-1squeeze3 | DLA-251-1 |
Advisories 2
- DSA-3265-1 zendframework - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-251-1 zendframework - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- [oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02 mailing-list
- MDVSA-2014:072 vendor-advisory
- http://advisories.mageia.org/MGASA-2014-0151.html
- 66358 vdb-entry
- DSA-3265 vendor-advisory
- http://framework.zend.com/security/advisory/ZF2014-02