CVE-2015-1796
EUVD-2022-295208.07.2015, 15:59
The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| shibboleth | identity_provider | 𝑥 ≤ 2.4.3 |
| shibboleth | opensaml_java | 𝑥 ≤ 2.6.4 |
𝑥
= Vulnerable software versions
Ubuntu Releases
Common Weakness Enumeration
References