CVE-2015-1796 Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

What is CVE-2015-1796?

CVE-2015-1796 is a medium-severity authentication bypass vulnerability in n/a, published on 8 Jul 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

Weakness: CWE-254

Which versions are affected by CVE-2015-1796?

4 open source packages ship an affected version, including edu.internet2.middleware:shibboleth-identityprovider and org.opensaml:opensaml. It affects 2 products.

Products include Shibboleth Identity Provider, Shibboleth Opensaml Java.

How do I fix CVE-2015-1796?

Upgrade edu.internet2.middleware:shibboleth-identityprovider to 2.4.4 or later.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2015-1796 being exploited?

There is no known exploitation of CVE-2015-1796 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2020-27978 Denial of service in n/a High 7.5
• CVE-2014-3603 Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java Medium 5.9

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-78fq-w796-q537.