CVE-2011-1411: OpenSAML library vulnerable to XML Signature wrapping attacks

[Peter Schober]

* gprestia <gregoriogianluca.prestia at amadeus.com> [2013-01-10 14:22]:
> Yes I have indeed looked at that page, where I can navigate the source tree
> via the browser.
> But when I try to perform an SVN anonymous checkout to have the full source
> base in local, I get errors as follows:
> 
> *** case 1: [redirect cycle error]
> > svn co http://svn.shibboleth.net/view/java-opensaml2/

wrong schema (http instead of https), wrong REQUEST_URI (/view is only
for webbrowsing)

> *** case 2: [authentication is required]
> > svn co https://svn.shibboleth.net/view/java-opensaml2/

wrong REQUEST_URI (see abov)

> *** case 3: [connection refused by server]
> > svn co svn://svn.shibboleth.net/view/cpp-opensaml

(differently) wrong schema (svn instead of https), wrong REQUEST_URI

> Being an open source project, I'm sure I can get the full source base
> "anonymously" to do a local build, so I'm wondering what I'm doing wrong
> with my SVN command...

A simple case of PEBKAC. The documentation says:

  Repository URL: https://svn.shibboleth.net/[REPO_NAME]

So by replacing [REPO_NAME] with e.g. java-opensaml2 you end up with e.g.

  svn ls https://svn.shibboleth.net/java-opensaml2

-peter