Date: Thu, 21 Mar 2024 14:41:20 GMT From: Ryan Steinmetz <zi@FreeBSD.org> To: ports-committers@FreeBSD.org, dev-commits-ports-all@FreeBSD.org, dev-commits-ports-main@FreeBSD.org Subject: git: a4a3e3be3c60 - main - security/shibboleth-idp: Document CAS SSRF vulnerability Message-ID: <202403211441.42LEfKVq082241@gitrepo.freebsd.org>
next in thread | raw e-mail | index | archive | help
The branch main has been updated by zi: URL: https://cgit.FreeBSD.org/ports/commit/?id=a4a3e3be3c6049b11f2d397fa2a4b1651544342a commit a4a3e3be3c6049b11f2d397fa2a4b1651544342a Author: Ryan Steinmetz <zi@FreeBSD.org> AuthorDate: 2024-03-21 14:41:14 +0000 Commit: Ryan Steinmetz <zi@FreeBSD.org> CommitDate: 2024-03-21 14:41:14 +0000 security/shibboleth-idp: Document CAS SSRF vulnerability --- security/vuxml/vuln/2024.xml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/security/vuxml/vuln/2024.xml b/security/vuxml/vuln/2024.xml index 3aeb70ba721b..8dd45661c4c8 100644 --- a/security/vuxml/vuln/2024.xml +++ b/security/vuxml/vuln/2024.xml @@ -1,3 +1,31 @@ + <vuln vid="7a7129ef-e790-11ee-a1c0-0050569f0b83"> + <topic>security/shibboleth-idp -- CAS service SSRF</topic> + <affects> + <package> + <name>shibboleth-idp</name> + <range><ge>4.3.0</ge><lt>4.3.2</lt></range> + <range><ge>5.0.0</ge><lt>5.1.1</lt></range> + </package> + </affects> + <description> + <body xmlns="http://www.w3.org/1999/xhtml">; + <p>Shibboleth Developers report:</p> + <blockquote cite="https://shibboleth.net/community/advisories/secadv_20240320.txt">; + <p>The Identity Provider's CAS support relies on a function in the + Spring Framework to parse CAS service URLs and append the ticket + parameter.</p> + </blockquote> + </body> + </description> + <references> + <url>https://shibboleth.net/community/advisories/secadv_20240320.txt</url>; + </references> + <dates> + <discovery>2024-03-20</discovery> + <entry>2024-03-21</entry> + </dates> + </vuln> + <vuln vid="a8448963-e6f5-11ee-a784-dca632daf43b"> <topic>databases/mongodb* -- Improper Certificate Validation</topic> <affects>
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?202403211441.42LEfKVq082241>