oss-sec mailing list archives
Re: New security advisory for Apache CXF
From: Hanno Böck <hanno () hboeck de>
Date: Sat, 14 Nov 2015 17:34:06 +0100
On Sat, 14 Nov 2015 15:32:32 +0000 Colm O hEigeartaigh <coheigea () apache org> wrote:
A new security advisory has been released for Apache CXF: CVE-2015-5253 <http://cxf.apache.org/security-advisories.data/CVE-2015-5253.txt.asc?version=1&modificationDate=1447433340000&api=v2>: Apache CXF SAML SSO processing is vulnerable to a wrapping attack
It's a bit hard to judge from the description what this is about. Am I right to assume that this is a fix for the XML encryption issues Juraj Somorovsky found? He just presented that at BH Amsterdam yesterday. Every app that is using XML encryption in any way should be checked for that. (and the tl;dr is: don't decrypt unauthenticated data) https://www.blackhat.com/eu-15/briefings.html#how-to-break-xml-encryption-automatically -- Hanno Böck http://hboeck.de/ mail/jabber: hanno () hboeck de GPG: BBB51E42
Attachment:
_bin
Description: OpenPGP digital signature
Current thread:
- New security advisory for Apache CXF Colm O hEigeartaigh (Nov 14)
- Re: New security advisory for Apache CXF Hanno Böck (Nov 14)