CVE-2014-3603 (Medium) detected in opensaml-2.6.1.jar

[mend-for-github-com]

CVE-2014-3603 - Medium Severity Vulnerability

Vulnerable Library - opensaml-2.6.1.jar

The OpenSAML-J library provides tools to support developers working with the Security Assertion Markup Language (SAML).

Library home page: http://opensaml.org/

Path to dependency file: /tmp/ws-scm/opensphere-desktop/open-sphere-plugins/wps/pom.xml

Path to vulnerable library: /root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar,/root/.m2/repository/org/opensaml/opensaml/2.6.1/opensaml-2.6.1.jar

Dependency Hierarchy:

• cxf-bundle-2.7.18.jar (Root Library)
  • ❌ opensaml-2.6.1.jar (Vulnerable Library)

Vulnerability Details

The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.

Publish Date: 2019-04-04

URL: CVE-2014-3603

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3603

Release Date: 2019-04-04

Fix Resolution: 2.6.2