Bug 865169 (CVE-2012-5352)

Summary:	CVE-2012-5352 JOSSO: vulnerable to authentication bypass and forged messages due to a Signature exclusion attack
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	djorm, pcheung
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2012-10-12 00:26:24 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	865172

Description Vincent Danen 2012-10-10 22:33:54 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5352 to
the following vulnerability:

Name: CVE-2012-5352
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5352
Assigned: 20121009
Reference: http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf

Java Open Single Sign-On Project Home (JOSSO) allows remote attackers
to forge messages and bypass authentication via a SAML assertion that
lacks a Signature element, aka a "Signature exclusion attack."

Comment 1 David Jorm 2012-10-12 00:26:24 UTC

Statement:

Not vulnerable. The JOSSO server component which exposes this flaw is not shipped in any Red Hat product. The JOSSO agent shipped with JBoss Enterprise Portal Platform does not expose this flaw.