FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

security/shibboleth-idp -- CAS service SSRF

Affected packages
4.3.0	<=	shibboleth-idp	<	4.3.2
5.0.0	<=	shibboleth-idp	<	5.1.1

Details

VuXML ID	7a7129ef-e790-11ee-a1c0-0050569f0b83
Discovery	2024-03-20
Entry	2024-03-21

Shibboleth Developers report:

The Identity Provider's CAS support relies on a function in the Spring Framework to parse CAS service URLs and append the ticket parameter.

[source]

References

URL	https://shibboleth.net/community/advisories/secadv_20240320.txt

Copyright © 2003-2005 Jacques Vidrine and contributors.
Please see the source of this document for full copyright information.