CVE-2014-3603
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
| Software | From | Fixed in |
|---|---|---|
| shibboleth / identity_provider | - | 2.4.1 |
| shibboleth / opensaml_java | - | 2.6.2 |
edu.internet2.middleware / shibboleth-identityprovider
|
- | 2.4.1 |
|
org.opensaml / opensaml
|
- | 2.6.2 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime