[Saml-admins] VB: Shibboleth Identity Provider Security Advisory [2024-03-20]

Hej, Här kommer en säkerhetsbulletin från Shibboleth. Björn skickade ut förra veckan. Pål ________________________________ Från: announce &lt;announce-bounces(a)shibboleth.net&gt; för Cantor, Scott via announce &lt;announce(a)shibboleth.net&gt; Skickat: den 20 mars 2024 13:47 Till: announce(a)shibboleth.net &lt;announce(a)shibboleth.net&gt; Ämne: Shibboleth Identity Provider Security Advisory [2024-03-20] -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Shibboleth Identity Provider Security Advisory [20 March 2024] CAS service URL handling vulnerable to Server-Side Request Forgery ================================================================== The Identity Provider's CAS support relies on a function in the Spring Framework to parse CAS service URLs and append the ticket parameter. Spring published an advisory regarding this function and re-opened the advisory again after their latest release. [1] Updates for both supported branches of the IdP are being provided to update the Spring Framework version to address the issue. Those not using the IdP's CAS protocol support are not impacted by this issue, though all are encouraged to upgrade at their next opportunity. Affected Versions ================= The Spring Framework bug is found in the versions outlined by their advisory [1]. This implicates Identity Provider versions < 5.1.1 and < 4.3.2 when CAS is in use. Recommendations =============== Upgrade to Identity Provider V5.1.1 or later. Upgrade to Identity Provider V4.3.2 or later (once available). References ========== URL for this Security Advisory http://shibboleth.net/community/advisories/secadv_20240320.txt [1] https://spring.io/security/cve-2024-22259 -- To unsubscribe from this list send an email to announce-unsubscribe(a)shibboleth.net