Bug 1534647 (CVE-2018-0486)

Summary:	CVE-2018-0486 xmltooling: impersonation attack and sensitive information disclosure in the Service Provider via crafted DTD
Product:	[Other] Security Response	Reporter:	Laura Pardo <lpardo>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	aileenc, apintea, bkundal, bmaxwell, bruno, cdewolf, chazlett, csutherl, darran.lofthouse, dimitris, dosoudil, fgavrilo, guido.grazioli, gvarsami, jawilson, jcoleman, jolee, jondruse, jshepherd, jstastny, kconner, ldimaggi, lgao, loleary, myarboro, nwallace, pavelp, pgier, pjurak, ppalaga, psakar, pslavice, rnetuka, rstancel, rsvoboda, rwagner, spinder, sstavrev, steve.traylen, tcunning, theute, tkirby, twalsh, vhalbert, vtunka
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	XMLTooling 1.6.3	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2018-02-14 19:35:17 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1534648
Bug Blocks:	1534662

Description Laura Pardo 2018-01-15 16:39:18 UTC

A flaw was found in Shibboleth XMLTooling-C. Versions before 1.6.3 mishandles digital signatures of user attribute data, which allows remote attackers to obtain sensitive information or conduct impersonation attacks via a crafted DTD.

The Service Provider software relies on a generic XML parser to process SAML responses and there are limitations in older versions of the parser that make it impossible to fully disable Document Type Definition (DTD) processing. Through addition/manipulation of a DTD, it's possible to make changes to an XML document that do not break a digital signature but are mishandled by the SP and its libraries. These manipulations can alter the user data passed through to applications behind the SP and result in impersonation attacks and exposure of protected information.

References: 
http://shibboleth.net/community/advisories/secadv_20180112.txt
https://issues.shibboleth.net/jira/browse/CPPXT-127

Comment 1 Laura Pardo 2018-01-15 16:40:55 UTC

Created xmltooling tracking bugs for this issue:

Affects: fedora-all [bug 1534648]

Comment 2 Jason Shepherd 2018-01-17 07:20:39 UTC

Only C++ versions of xmltooling are affected, not Java. Marking JON as not affected.

Comment 3 Hooman Broujerdi 2018-01-17 22:48:35 UTC

For the same reason Fuse is not affected either.

Comment 4 Jason Shepherd 2018-02-14 07:34:21 UTC

Chess: Can you check JPP and JDG?

Comment 5 Chess Hazlett 2018-02-14 19:33:24 UTC

JDG ships java version. Notaffected. JPP does not appear to ship, but would be a WONTFIX anyway.

Comment 6 Chess Hazlett 2018-02-14 19:34:41 UTC

Closing flaw. Nothing to do.