Bug 725526 (CVE-2011-1411) - CVE-2011-1411 opensaml: vulnerable to XML signature wrapping attacks
Summary: CVE-2011-1411 opensaml: vulnerable to XML signature wrapping attacks
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: CVE-2011-1411
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 725557
Blocks:
TreeView+ depends on / blocked
 
Reported: 2011-07-25 19:04 UTC by Bruno Wolff III
Modified: 2019-09-29 12:46 UTC (History)
4 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2011-09-29 06:04:39 UTC
Embargoed:

Attachments (Terms of Use)

Description Bruno Wolff III 2011-07-25 19:04:04 UTC 
Description of problem:
http://shibboleth.internet2.edu/secadv/secadv_20110725.txt

Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.
  
Actual results:


Expected results:


Additional info:
Comment 1 Vincent Danen 2011-07-25 20:27:03 UTC 
It was reported that the Shibboleth Project's OpenSAML software was vulnerable to XML signature wrapping attacks.

Version 2.4.3 corrects this flaw.
Comment 2 Vincent Danen 2011-07-25 20:33:38 UTC 
Created opensaml tracking bugs for this issue

Affects: fedora-all [bug 725557]
Comment 3 Guido Grazioli 2011-09-12 07:08:15 UTC 
xmltooling 1.4.2 / opensaml 2.4.3 build in rawhide
Comment 4 Guido Grazioli 2011-09-29 06:04:39 UTC 
The vulnerability has been addressed in:
 opensaml-2.4.3-1 (rawhide)
 opensaml-2.3-6 (f16 updates-testing, submitted for stable)
 opensaml-2.3-4 (f15 updates)
Note You need to log in before you can comment on or make changes to this bug.