[prev in list] [next in list] [prev in thread] [next in thread] 

List:       shibboleth-announce
Subject:    Shibboleth Identity Provider Security Advisory - [13 August 2014]
From:       "Cantor, Scott" <cantor.2 () osu ! edu>
Date:       2014-08-14 13:21:56
Message-ID: D0123033.5493F%cantor.2 () osu ! edu
[Download RAW message or body]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Shibboleth Identity Provider Security Advisory [13 August 2014]

HTTPS Connections Via HTTP Resources Do Not Perform Hostname Verification
========================================================================
The HttpResource and FileBackedHttpResource implementations in OpenSAML
and the IdP make use of the Jakarta Commons HttpClient version 3.x. When
used with an HTTPS scheme, HttpClient by default does not perform
verification of the server hostname against the server's X.509 certificate.
The lack of hostname verification means that while the connection between
the client and HTTPS server is encrypted, the client has no way to verify
it's actually communicating with the appropriate HTTPS server hosting the
resource data.

In the IdP, HttpResource and FileBackedHttpResource might commonly be used
within service.xml to enable fetching of remote configuration resources
for services from an HTTP server. They might less commonly be used in
relying-party.xml in conjunction with a ResourceBackedMetadataProvider.


Affected Versions
================
Versions of the Identity Provider < 2.4.1

Versions of OpenSAML Java < 2.6.2


Recommendations
==============IdP users: Upgrade to IdP 2.4.1 or greater, which globally configures
an appropriate hostname verifier for use with HttpClient. If this is
not feasible, and the only use of these resource types is with a
ResourceBackedMetadataProvider, then consider replacing the latter
with either a HTTPMetadataProvider or FileBackedHTTPMetadataProvider.

OpenSAML users: Upgrade to OpenSAML Java 2.6.2 or greater, which
globally configures an appropriate hostname verifier for use with
HttpClient.  If this is not feasible, it is also possible to replicate
in your own code the registration of the appropriate hostname-verifying
socket factory added in 2.6.2. See the HttpClient 3.x web site,
or contact the Shibboleth developer list for details.

Note that in IdP v2.4.0 and above, use of the HTTP metadata provider
configuration option 'disregardSslCertificate' will globally disable
HttpClient hostname verification as well as TLS certificate trust
evaluation. This would include the HttpResource hostname verification
being added in the 2.4.1 release.  This is a limitation caused by API
issues with HttpClient 3.x, and will be addressed in the 3.x version
of the Identity Provider. See the following related security advisory:
http://shibboleth.net/community/advisories/secadv_20130417.txt


Credits
======Kaspar Brand, SWITCH


URL for this Security Advisory
http://shibboleth.net/community/advisories/secadv_20140813.txt

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIcBAEBCgAGBQJT67VMAAoJEDeLhFQCJ3liPnEQALQMl0eCGD+5gUOpGf1MGrmC
BiWrwDrLuns4+5EzN5nvZc0iydJL46ZiBtvptGt9/QGgZB+uzx8RcuiN/juHzTr7
fgliqreVyJIqu+X0x63+B1fTT3QNxz4Vj8vqj8f8RiOSUX/BDn6sBUVIthkH85eK
XnOZOFpnqb6ziuu49vApt3mkwcJsaOQTaYpR9d7vk5LRT4auUI44m4Db37ARtTWm
0j/IUwLJnTPxLXn/HdG+yWHXRTaGUCdVhKggBPa47Wel6z5mdiKSpJn2F5t2GSNo
Q/BERC24kDyuebzzS5oNdpPmBE3QL7Nl/fHU7k/vZ+75nZwkpuhpgNonTO4PrkBl
W1h2sDUqKnxYvy9Y/58lTtDK0C+VcIn1he6bpUwG+DBCVBvicHR1yUuDktBsRNRb
78sRZpeAMoNVHfEe8+I/8RAlIr9gmuGh2nAR45DjOsDLIb/u4cAodN2sz7pijKzB
HtMgNuDN0J4F32HD77R2MjxTUvg2cAvjLstFm8RNg4WbCIZRBn39kNswG6pLfFxh
98Ki848uGSCSFBdISQF7mR5bXfgPFhdFnezwkuH34D/50etdwKex6dkgi0mYB8bN
MDQU3oYOjZ4ZkRlCivHBmYKLjmwdon5zQLQ+FMwBxxJCXE97xWEm+XIypC9bMzaX
fgARGn/wdTpelE7OiMlJ
 Eq
-----END PGP SIGNATURE-----


--
To unsubscribe from this list send an email to announce-unsubscribe@shibboleth.net
[prev in list] [next in list] [prev in thread] [next in thread]