Bug 725526 (CVE-2011-1411)

Summary: CVE-2011-1411 opensaml: vulnerable to XML signature wrapping attacks
Product: [Other] Security Response Reporter: Bruno Wolff III <bruno>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED CURRENTRELEASE QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bruno, guido.grazioli, jrusnack, vdanen
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2011-09-29 06:04:39 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Bug Depends On: 725557    
Bug Blocks:    

Description Bruno Wolff III 2011-07-25 19:04:04 UTC
Description of problem:
http://shibboleth.internet2.edu/secadv/secadv_20110725.txt

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:

Comment 1 Vincent Danen 2011-07-25 20:27:03 UTC
It was reported that the Shibboleth Project's OpenSAML software was vulnerable to XML signature wrapping attacks.

Version 2.4.3 corrects this flaw.

Comment 2 Vincent Danen 2011-07-25 20:33:38 UTC
Created opensaml tracking bugs for this issue

Affects: fedora-all [bug 725557]

Comment 3 Guido Grazioli 2011-09-12 07:08:15 UTC
xmltooling 1.4.2 / opensaml 2.4.3 build in rawhide

Comment 4 Guido Grazioli 2011-09-29 06:04:39 UTC
The vulnerability has been addressed in:
 opensaml-2.4.3-1 (rawhide)
 opensaml-2.3-6 (f16 updates-testing, submitted for stable)
 opensaml-2.3-4 (f15 updates)