Bug 865169 (CVE-2012-5352) - CVE-2012-5352 JOSSO: vulnerable to authentication bypass and forged messages due to a Signature exclusion attack
Summary: CVE-2012-5352 JOSSO: vulnerable to authentication bypass and forged messages ...
Keywords:
Status: CLOSED NOTABUG
Alias: CVE-2012-5352
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks: 865172
TreeView+ depends on / blocked
 
Reported: 2012-10-10 22:33 UTC by Vincent Danen
Modified: 2021-02-23 13:40 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2012-10-12 00:26:24 UTC
Embargoed:

Attachments (Terms of Use)

Description Vincent Danen 2012-10-10 22:33:54 UTC 
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5352 to
the following vulnerability:

Name: CVE-2012-5352
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5352
Assigned: 20121009
Reference: http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf

Java Open Single Sign-On Project Home (JOSSO) allows remote attackers
to forge messages and bypass authentication via a SAML assertion that
lacks a Signature element, aka a "Signature exclusion attack."
Comment 1 David Jorm 2012-10-12 00:26:24 UTC 
Statement:

Not vulnerable. The JOSSO server component which exposes this flaw is not shipped in any Red Hat product. The JOSSO agent shipped with JBoss Enterprise Portal Platform does not expose this flaw.
Note You need to log in before you can comment on or make changes to this bug.