CVE-2016-8638 Session Fixation in ipsilon
An unauthenticated attacker can view and terminate active sessions of other users in Ipsilon, causing denial of service and bypassing session security.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2016-8638?
CVE-2016-8638 is a critical authentication bypass vulnerability in n/a, published on 12 Jul 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 was found that allows attacker to log out active sessions of other users. This issue is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also called a "SAML2 multi-session vulnerability."
Weakness: CWE-384
Which versions are affected by CVE-2016-8638?
9 open source packages ship an affected version, including ipsilon. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ipsilon PyPI | From 1.0.0 | 1.0.3, 1.1.2, 2.0.2, 1.2.1 |
ipsilon PyPI | From 1.0.0 | 1.0.3 |
ipsilon PyPI | From 1.0.0 | 1.0.3 |
ipsilon PyPI | From 1.1.0 | 1.1.2 |
ipsilon PyPI | From 1.1.0 | 1.1.2 |
ipsilon PyPI | From 1.2.0 | 1.2.1 |
3 more packages
ipsilon PyPI | From 1.2.0 | 1.2.1 |
ipsilon PyPI | From 2.0.0 | 2.0.2 |
ipsilon PyPI | From 2.0.0 | 2.0.2 |
Linux distribution packages (12)
ipsilon Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-authform Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-authgssapi Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-authldap Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-base Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-client Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-filesystem Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-infosssd Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-persona Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-saml2 Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-saml2-base Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
ipsilon-tools-ipa Red Hat:enterprise_linux:7::server | All versions | 0:1.0.0-13.el7_3 |
Products include Ipsilon Project Ipsilon.
How do I fix CVE-2016-8638?
Upgrade ipsilon to a fixed version for your release line: 1.0.3, 1.1.2, 2.0.2 or 1.2.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2016-8638 being exploited?
There is no known exploitation of CVE-2016-8638 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as CVE-2017-16855, GHSA-376m-3rm2-9jm6, PYSEC-2026-360, RHSA-2016:2809.