Shibboleth Identity Provider Plugin Security Advisory [23 October 2024]

[Henri Mikkonen]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

Shibboleth Identity Provider Plugin Security Advisory [23 October 2024]

An updated version of the OpenID Connect OP plugin for the Shibboleth
Identity Provider is now available which corrects a pair of race
conditions in the authorization/authentication request processing.

Both issues are of "low" severity, and neither is likely to manifest
without significant load on the server.

OpenID Connect OP plugin contains two race conditions
======================================================================
A pair of race conditions have been identified in the OP plugin.

The authorization endpoint that processes requests from RP clients
contains a race condition that under load could result in requests
containing a login_hint and/or resource -parameter value from a
different request.

A wrong login hint value may cause unexpected user experience for
instance in the login page if the login view has been modified to
exploit login hint. Our default login views don't include such
feature.

A wrong resource value may cause invalid target audience in the issued
access token or unexpected user experience if the wrong audience is
invalid for the client. Note that regardless of this bug, the resource
values ultimately processed are validated against the actual client's
metadata.

Recommendations
===============
Update to V4.2.0 or later of the OIDC OP plugin, which is now available.
The IdP's plugin installer can perform this update process. The Release
Notes are available at [1].

Note that this plugin requires IdP V5.0 or newer, so you may need to update
the IdP first if you are on an unsupported version.


Credits
=======
This issue was discovered by the Shibboleth Project team itself.

[1] https://shibboleth.atlassian.net/wiki/x/AQCCpQ

URL for this Security Advisory:
https://shibboleth.net/community/advisories/secadv_20241023.txt
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEbRj9Y3CPzKB5tozOAmaRg5NV68oFAmcX3R8ACgkQAmaRg5NV
68rQhg/7BqJgkWZvTixN5jftXr1X/pC08nuAbsG0sMwTUtO03fb0M4RxDfpEYS1T
P4Tlqo0PjQs70fdoOLDWd1yIz7moOpjzlLNCjcCtt6W1re9R0BNO9kI0/GWAtckT
pakONEo5k5SyjdI7Xw4WS311M743ZxVsl6yVmTnlvNWt56ZZfo7e0ZylT+Bx/fYG
qkg834ygsCH3iOW3eyo+/fBnbuMJSQKVqgd5Ky1c3YwlHpYMGPGURFd//JW/w6js
ZfbBASXFqSg8ugHl0nplhXWr1AX7XU1uU9WmySPEN8DM651/Boafs5lWxyqOPddv
cIirSWc67BoUbaVleHgeJ2uDKYXKIpoxkc7yI8grz4ukoHwgG1/fEeVIyguAuDBa
Ozc4gKUIymBOh8WmOc6N/AKRnI1SYJ6MeXyxRxAdHFKNi22RDGlLGPMOST35Czm+
0CF6qjmfJdM1cF7bKIhM4Mb4LaZwR45QCPQrh7NhyiooKPgh7ru2DBSuF8bWhckn
e6r3fp2JZN3vXJ5HrhGGZ9AQ/rd1+6dqfrf089yygXtGPd25TD0vMKQLx5Ujx+Kb
hNnm2kanfzSqIJZXXOYyVdO76l5OmD+7iHr5HwNMwE7vH0In+0X/+sOWLzKF8F/f
l/lTuWYJCAmwSdGhnTOx5uWzjxEenbY0gPdRRLe7AXqyyeznM7M=
=qfKp
-----END PGP SIGNATURE-----