Red Hat Bugzilla – Bug 1131359
CVE-2014-3527 Spring Security CAS: Access control bypass via untrusted infomation usage in proxy ticket authentication
Last modified: 2015-07-31 08:35:40 EDT
When using Spring Security's CAS Proxy ticket authentication a malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated. This is due to the fact that the proxy ticket authentication uses the information from the HttpServletRequest which is populated based upon untrusted information within the HTTP request. A remote attacker could use this flaw to bypass any access control restrictions on which CAS services can authenticate to one another. References: http://www.gopivotal.com/security/cve-2014-3527 https://spring.io/blog/2014/08/15/cve-2014-3527-fixed-in-spring-security-3-2-5-and-3-1-7 Upstream Issue: https://jira.spring.io/browse/SEC-2688
Created springframework-security tracking bugs for this issue: Affects: fedora-all [bug 1131361]
Upstream Commits: spring-security-cas/master https://github.com/spring-projects/spring-security/commit/934937d9c1dc20c396b96c08310b72cfa627acbf https://github.com/spring-projects/spring-security/commit/533b71b9b8e066865837933a90ca4210523906f0 spring-security-cas/3.1.x https://github.com/spring-projects/spring-security/commit/b78bd897cde12699facde01e1780039ee43ac858 spring-security-cas/3.2.x https://github.com/spring-projects/spring-security/commit/2cb99f079152ac05cee5c90457c7feb3bb2de55e
Victims Record: https://github.com/victims/victims-cve-db/blob/master/database/java/2014/3527.yaml
Statement: This issue did not affect the versions of spring-security-cas provided by jasperreports-server-pro as shipped with Red Hat Enterprise Virtualization Manager 3 as they did not include support for CAS Proxy Service URL configuration via request parameters.
springframework-security-3.1.7-1.fc19 has been pushed to the Fedora 19 stable repository. If problems still persist, please make note of it in this bug report.
springframework-security-3.1.7-1.fc20 has been pushed to the Fedora 20 stable repository. If problems still persist, please make note of it in this bug report.