VYPR

Opensaml Java

by Internet2

CVEs (2)

  • CVE-2014-3603MedApr 4, 2019
    risk 0.38cvss 5.9epss 0.01

    The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509…

  • CVE-2015-1796Jul 8, 2015
    risk 0.00cvss epss 0.01

    The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued…