diff options
| author | feld <feld@FreeBSD.org> | 2015-07-25 00:58:16 +0800 |
|---|---|---|
| committer | feld <feld@FreeBSD.org> | 2015-07-25 00:58:16 +0800 |
| commit | a73ef3219827a46ed024306ae592d3952ba1fa55 (patch) | |
| tree | 340ef38f97a9fe6f431cceffb8300b221fa6a15b | |
| parent | 3c2bef4b0f7c312196aa548b39cb08ea509495de (diff) | |
| download | freebsd-ports-gnome-a73ef3219827a46ed024306ae592d3952ba1fa55.tar.gz freebsd-ports-gnome-a73ef3219827a46ed024306ae592d3952ba1fa55.tar.zst freebsd-ports-gnome-a73ef3219827a46ed024306ae592d3952ba1fa55.zip | |
Document shibboleth DoS
Security: CVE-2015-2684
| -rw-r--r-- | security/vuxml/vuln.xml | 48 |
1 files changed, 48 insertions, 0 deletions
diff --git a/security/vuxml/vuln.xml b/security/vuxml/vuln.xml index 7693b850770c..cacffe1223fa 100644 --- a/security/vuxml/vuln.xml +++ b/security/vuxml/vuln.xml @@ -58,6 +58,54 @@ Notes: --> <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1"> + <vuln vid="b202e4ce-3114-11e5-aa32-0026551a22dc"> + <topic>shibboleth-sp -- DoS vulnerability</topic> + <affects> + <package> + <name>xmltooling</name> + <range><lt>1.5.5</lt></range> + </package> + <package> + <name>opensaml2</name> + <range><lt>2.5.5</lt></range> + </package> + <package> + <name>shibboleth-sp</name> + <range><lt>2.5.5</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml"> + <p>Shibboleth consortium reports:</p> + <blockquote cite="http://shibboleth.net/community/advisories/secadv_20150721.txt"> + <p> + Shibboleth SP software crashes on well-formed but invalid XML. + </p> + <p> + The Service Provider software contains a code path with an uncaught + exception that can be triggered by an unauthenticated attacker by + supplying well-formed but schema-invalid XML in the form of SAML + metadata or SAML protocol messages. The result is a crash and so + causes a denial of service. + </p> + <p> + You must rebuild opensaml and shibboleth with xmltooling-1.5.5 or + later. The easiest way to do so is to update the whole chain including + shibboleth-2.5.5 an opensaml2.5.5. + </p> + </blockquote> + </body> + </description> + <references> + <url>http://shibboleth.net/community/advisories/secadv_20150721.txt</url> + <cvename>CVE-2015-2684</cvename> + </references> + <dates> + <discovery>2015-07-21</discovery> + <entry>2015-07-23</entry> + </dates> + </vuln> + <vuln vid="c80b27a2-3165-11e5-8a1d-14dae9d210b8"> <topic>wordpress -- XSS vulnerability</topic> <affects> |