shibboleth opensaml java vulnerabilities

Latest shibboleth opensaml java CVEs

Newest publication first

1. CVE-2014-3603 Improper Validation of Certificate with Host Mismatch in Shibboleth Identity Provider and OpenSAML Java

   Published 2019-04-04

   Medium·CVSS 5.9 EPSS 0.84%

   The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certi...

2. CVE-2015-1796 Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML

   Published 2015-07-08

   Medium·CVSS 4.3 EPSS 1.2%

   The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.