Description
A misconfiguration of RSA padding implemented in the PingID Adapter for PingFederate to support Offline MFA with PingID mobile authenticators is vulnerable to pre-computed dictionary attacks, leading to a bypass of offline MFA.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ping Identity | PingID Adapter for PingFederate | 2.13.2 – < 2.13.2 | 2.13.2 |
| Ping Identity | PingID Integration Kit (includes PingID Adapter) | 2.24 – < 2.24 | 2.24 |
| Ping Identity | PingFederate (includes PingID Adapter) | 11.1.0 – < 11.1.0*, 11.1.5 – ≤ 11.1.5, 11.2.0 – < 11.2.0*, 11.2.2 – ≤ 11.2.2 | 11.1.0* |