Date: Sat, 14 Nov 2015 17:34:06 +0100 From: Hanno Böck <hanno@...eck.de> To: oss-security@...ts.openwall.com Subject: Re: New security advisory for Apache CXF On Sat, 14 Nov 2015 15:32:32 +0000 Colm O hEigeartaigh <coheigea@...che.org> wrote: > A new security advisory has been released for Apache CXF: > > CVE-2015-5253 > <http://cxf.apache.org/security-advisories.data/CVE-2015-5253.txt.asc?version=1&modificationDate=1447433340000&api=v2>: > Apache CXF SAML SSO processing is vulnerable to a wrapping attack It's a bit hard to judge from the description what this is about. Am I right to assume that this is a fix for the XML encryption issues Juraj Somorovsky found? He just presented that at BH Amsterdam yesterday. Every app that is using XML encryption in any way should be checked for that. (and the tl;dr is: don't decrypt unauthenticated data) https://www.blackhat.com/eu-15/briefings.html#how-to-break-xml-encryption-automatically -- Hanno Böck http://hboeck.de/ mail/jabber: hanno@...eck.de GPG: BBB51E42 [ CONTENT OF TYPE application/pgp-signature SKIPPED ]
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Powered by Openwall GNU/*/Linux - Powered by OpenVZ