Shibboleth Identity Provider Advisory [Updated 2024-04-15]

[Cantor, Scott]

 -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Shibboleth Identity Provider Security Advisory [20 March 2024]
Updated [15 April 2024]

CAS service URL handling vulnerable to Server-Side Request Forgery
==================================================================
The Identity Provider's CAS support relies on a function in the
Spring Framework to parse CAS service URLs and append the ticket
parameter. Spring published an advisory regarding this function
and re-opened the advisory again after their latest release. [1]

Updates for both supported branches of the IdP are being provided
to update the Spring Framework version to address the issue.

Those not using the IdP's CAS protocol support are not impacted
by this issue, though all are encouraged to upgrade at their next
opportunity.

Affected Versions
=================
The Spring Framework bug is found in the versions outlined by
their advisories [1][2].

This implicates Identity Provider versions < 5.1.2 and < 4.3.3
when CAS is in use.

Recommendations
===============
Upgrade to Identity Provider V5.1.2 or later.
Upgrade to Identity Provider V4.3.3 or later.

Update History
==============
Updated on April 15th, 2024 to incorporate a third Spring advisory
and update the affected and corrected IdP versions as above.

References
==========
URL for this Security Advisory
http://shibboleth.net/community/advisories/secadv_20240320.txt

[1] https://spring.io/security/cve-2024-22259
[2] https://spring.io/security/cve-2024-22262

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE3KoVAHvtneaQzZUjN4uEVAIneWIFAmYdVh0ACgkQN4uEVAIn
eWJZlQ/9GFOWT4bTMIHbQS2Wbzdo2jLC3E7AFkcdbgdNziyimWnCEZlmL51U7qII
6+LHrW5KxjIggjYjHKaFrlVga/bBwAVMaFvG/whRMTE8SqAS5JmdX+RHIs+V+XVk
uvuhD6T293OBHCGG9yoYnoFCmUfsVjV1tWNOPY0L5LUPZj99PZ9KdxaCz15DJfXn
CzgW5p0YsR3ABx4XcKLA5J/5JFQqk/T7ED1sdK9cymWOhOiOn5Z9wUI3bxl0f41N
ud9F4UJfQeZJ9FwVWERE2K24piF4VvethP+P3sBgEGHJsFSokdM4yOK0uvJmwP6t
SNcpDV9eLRYYkirxGthey9WKmG5lBtjsXObgIf2uM9ZX4mPO+jgqOfuS+juHJ9DK
2aq6kAEhPSYFeLCkBjn0jMFXsosJH5VLtHQm24rLDnyzUToAtqrvZGS2k5pYyiVD
OC0tV0aBYseeBh4zaEZCj+Q+A5sZLEYvRRxibN8Ed2s0qlslANEipNYtAaDzp2cU
+qz5N/6CdiDbWjRVb/e2KrJ1bm0MSkGFG2AqqE5dcbkcbrYPkdFNttaXs+l9Yt6H
bttd41zQImpyKwQm8UdcuKL2pip2B2EOZJUYdk05g9JROhyt3ZQtLc/137rnvjXp
KT8yeZbPZ5c902ffnispkZQgRA0xW4DoJTOsNG7bNu9Qg3mCc0w=
=uHGO
-----END PGP SIGNATURE-----