CVE-2015-1796 (Medium) detected in opensaml-2.5.1-1.jar - autoclosed - autoclosed - autoclosed - autoclosed - autoclosed - autoclosed - autoclosed

[mend-for-github-com[bot]]

CVE-2015-1796 - Medium Severity Vulnerability

Vulnerable Library - opensaml-2.5.1-1.jar

The OpenSAML-J library provides tools to support developers working with the Security Assertion Markup Language (SAML).

Path to dependency file: ready-aws-plugin/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/org/opensaml/opensaml/2.5.1-1/opensaml-2.5.1-1.jar

Dependency Hierarchy: - ready-api-soapui-pro-1.3.0.jar (Root Library) - ready-api-soapui-1.3.0.jar - wss4j-1.6.14.jar - :x: **opensaml-2.5.1-1.jar** (Vulnerable Library)

Found in HEAD commit: 3df791878e4133498f61805bd442d5e371c981f7

Found in base branch: master

Vulnerability Details

The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.

Publish Date: 2015-07-08

URL: CVE-2015-1796

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1796

Release Date: 2015-07-08

Fix Resolution: 2.6.5

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.

[mend-for-github-com[bot]]

:heavy_check_mark: This issue was automatically closed by WhiteSource because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the WhiteSource inventory.