CVE-2014-2685 The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only tha...
HighCVSS 7.5
EPSS 2.8%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The GenericConsumer class in the Consumer component in ZendOpenId before 2.0.2 and the Zend_OpenId_Consumer class in Zend Framework 1 before 1.12.4 violate the OpenID 2.0 protocol by ensuring only that at least one field is signed, which allows remote attackers to bypass authentication by leveraging an assertion from an OpenID provider.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zend framework | <= 1.12.3 | No fix listed |
| zend framework | = 1.0.0 | No fix listed |
| zend framework | = 1.0.0-rc1 | No fix listed |
| zend framework | = 1.0.0-rc2 | No fix listed |
| zend framework | = 1.0.0-rc2a | No fix listed |
| zend framework | = 1.0.0-rc3 | No fix listed |
| zend framework | = 1.0.1 | No fix listed |
| zend framework | = 1.0.2 | No fix listed |
| zend framework | = 1.0.3 | No fix listed |
| zend framework | = 1.0.4 | No fix listed |
| zend framework | = 1.5.0 | No fix listed |
| zend framework | = 1.5.0-pl | No fix listed |
| zend framework | = 1.5.0-pr | No fix listed |
| zend framework | = 1.5.0-rc1 | No fix listed |
| zend framework | = 1.5.0-rc2 | No fix listed |
| zend framework | = 1.5.0-rc3 | No fix listed |
| zend framework | = 1.5.1 | No fix listed |
| zend framework | = 1.5.2 | No fix listed |
| zend framework | = 1.5.3 | No fix listed |
| zend framework | = 1.6.0 | No fix listed |
| zend framework | = 1.6.0-rc1 | No fix listed |
| zend framework | = 1.6.0-rc2 | No fix listed |
| zend framework | = 1.6.0-rc3 | No fix listed |
| zend framework | = 1.6.1 | No fix listed |
| zend framework | = 1.6.2 | No fix listed |
Show 72 more
| Product | Affected versions | Fixed in |
|---|---|---|
| zend framework | = 1.7.0 | No fix listed |
| zend framework | = 1.7.0-pl1 | No fix listed |
| zend framework | = 1.7.0-pr | No fix listed |
| zend framework | = 1.7.1 | No fix listed |
| zend framework | = 1.7.2 | No fix listed |
| zend framework | = 1.7.3 | No fix listed |
| zend framework | = 1.7.3-pl1 | No fix listed |
| zend framework | = 1.7.4 | No fix listed |
| zend framework | = 1.7.5 | No fix listed |
| zend framework | = 1.7.6 | No fix listed |
| zend framework | = 1.7.7 | No fix listed |
| zend framework | = 1.7.8 | No fix listed |
| zend framework | = 1.7.9 | No fix listed |
| zend framework | = 1.8.0 | No fix listed |
| zend framework | = 1.8.0-a1 | No fix listed |
| zend framework | = 1.8.0-b1 | No fix listed |
| zend framework | = 1.8.1 | No fix listed |
| zend framework | = 1.8.2 | No fix listed |
| zend framework | = 1.8.3 | No fix listed |
| zend framework | = 1.8.4 | No fix listed |
| zend framework | = 1.8.4-pl1 | No fix listed |
| zend framework | = 1.8.5 | No fix listed |
| zend framework | = 1.9.0 | No fix listed |
| zend framework | = 1.9.0-a1 | No fix listed |
| zend framework | = 1.9.0-b1 | No fix listed |
| zend framework | = 1.9.0-rc1 | No fix listed |
| zend framework | = 1.9.1 | No fix listed |
| zend framework | = 1.9.2 | No fix listed |
| zend framework | = 1.9.3 | No fix listed |
| zend framework | = 1.9.3-pl1 | No fix listed |
| zend framework | = 1.9.4 | No fix listed |
| zend framework | = 1.9.5 | No fix listed |
| zend framework | = 1.9.6 | No fix listed |
| zend framework | = 1.9.7 | No fix listed |
| zend framework | = 1.9.8 | No fix listed |
| zend framework | = 1.10.0 | No fix listed |
| zend framework | = 1.10.0-alpha1 | No fix listed |
| zend framework | = 1.10.0-beta1 | No fix listed |
| zend framework | = 1.10.0-rc1 | No fix listed |
| zend framework | = 1.10.1 | No fix listed |
| zend framework | = 1.10.2 | No fix listed |
| zend framework | = 1.10.3 | No fix listed |
| zend framework | = 1.10.4 | No fix listed |
| zend framework | = 1.10.5 | No fix listed |
| zend framework | = 1.10.6 | No fix listed |
| zend framework | = 1.10.7 | No fix listed |
| zend framework | = 1.10.8 | No fix listed |
| zend framework | = 1.10.9 | No fix listed |
| zend framework | = 1.11.0 | No fix listed |
| zend framework | = 1.11.0-b1 | No fix listed |
| zend framework | = 1.11.0-rc1 | No fix listed |
| zend framework | = 1.11.1 | No fix listed |
| zend framework | = 1.11.2 | No fix listed |
| zend framework | = 1.11.3 | No fix listed |
| zend framework | = 1.11.4 | No fix listed |
| zend framework | = 1.11.5 | No fix listed |
| zend framework | = 1.11.6 | No fix listed |
| zend framework | = 1.11.7 | No fix listed |
| zend framework | = 1.11.8 | No fix listed |
| zend framework | = 1.11.9 | No fix listed |
| zend framework | = 1.11.10 | No fix listed |
| zend framework | = 1.11.11 | No fix listed |
| zend framework | = 1.11.12 | No fix listed |
| zend framework | = 1.11.13 | No fix listed |
| zend framework | = 1.12.0 | No fix listed |
| zend framework | = 1.12.0-rc1 | No fix listed |
| zend framework | = 1.12.0-rc2 | No fix listed |
| zend framework | = 1.12.0-rc3 | No fix listed |
| zend framework | = 1.12.0-rc4 | No fix listed |
| zend framework | = 1.12.1 | No fix listed |
| zend framework | = 1.12.2 | No fix listed |
| zendopenid | <= 2.0.1 | No fix listed |
References
- advisories.mageia.org
- framework.zend.com vendor-advisory
- [oss-security] 20140331 CVE requests: Zend Framework issues fixed in ZF2014-01 and ZF2014-02 mailing-list
- DSA-3265 vendor-advisory
- MDVSA-2014:072 vendor-advisory
- 66358 vdb-entry