Shibboleth Identity Provider Plugin Security Advisory [12 May 2023]

[Cantor, Scott]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Shibboleth Identity Provider Plugin Security Advisory [12 May 2023]

An updated version of the OpenID Connect OP plugin for the Shibboleth
Identity Provider is now available which corrects a pair of race
conditions in the client authentication and dynamic registration
features.

Both issues are of "low" severity, and neither is likely to manifest
without significant load on the server.

OpenID Connect OP plugin contains multiple race conditions
======================================================================
A pair of race conditions have been identified in the OP plugin.

The client authentication feature that processes requests from
RP clients to validate access to the OP's endpoints contains a race
condition that under load could result in clients being successfully
validated with a client secret associated with a different client.

This is difficult to exploit due to the lack of predictability, and
would require a client have access to a client secret associated
with a different client being validated at the same time.

A second, less critical race condition was found in the part of the
dynamic client registration support involving metadata policy.
Unknown claims that are intended to be ignored and dropped may be
validated by the wrong policy and could be included in a client's
registration if allowed by the policy applied by mistake.


Recommendations
===============
Update to V3.4.0 or later of the OIDC OP plugin, which is now available.
The IdP's plugin installer can perform this update process.

Note that this plugin requires IdP V4.3, so you may need to patch the
IdP first if you are on an unsupported version.

This minor update includes some changes that may affect a small number of
deployments, so please review the Release Notes [1] when upgrading.


Credits
=======
This issue was discovered by the Shibboleth Project team itself.

[1] https://shibboleth.atlassian.net/wiki/x/AQCCpQ

URL for this Security Advisory:
https://shibboleth.net/community/advisories/secadv_20230512.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAmRiLEgACgkQN4uEVAIn
eWIkiw//YPbYW95ELEaw0/7R/KgvjZfNgG+vLN0GWpw6LjuMFEKK3ePVj0XNSyNt
8pr31xgAUnvpkmuEyYySuqnBFVjfQTqePEjm1t3ecXdYFu6LAgMDCddkEGTc4GLH
xIxgButsha2bloDaJApOIZcRRursuP2+FLCJsRaVUcaqF5nmO9zmEkaeXirQHYFk
lSyshd4LJ2RQsr4atpyW6okvS1GYiozbnsqOV8hpX3WbW78PlvqkXDCvSlnRQQEc
WZLNT/l6w4U2/tTdxw15lEF9DwMta95522lE5LhTJG2lUnQsgFvh2+j9mXPGqTRT
PJ8/vvY05ZkZyf0r/tyqUVxz9wBYttDefen2dxL5EfPZLg7C0uoIz3W2/9hwkz2U
vHcV69umawTSENRejRGFkP0llS5Eulz16QfNyYYbtetif6429mhUEmJ8+BeD8csp
sfB8Ykoge1AL14FPgr9jgevHouytS9zzGsFGTgNJdLVPhPvF6AfQ+ZGItSXbTAKV
Tsn+wXUbRl0MUojNG3z9QWeHqWqetU/scsOexa+p5jUrg2Dbfyc1/1ZFkUyHrYlW
Okm0mAH2b4n9Wb0Lfh4Hz8qYP/4eQzq8NgkDIvWVETS+ThxxUT+qXejW/jLVZclk
EoR04xCyKbqvKFXNCJsLrvLNtqAHHTc2SINxplpMq9uEW6JBFvs=
=KqT5
-----END PGP SIGNATURE-----