Security issue on Java OpenSaml Library

[Ian Young]

> On 2020-06-17, at 11:08, MIN ZHU <minmin3772 at gmail.com> wrote:
> 
> I am using opensaml-security-api Java lib in my project. As shown in MavenRepository, the latest version is 3.4.5. (https://mvnrepository.com/artifact/org.opensaml/opensaml-security-api/3.4.5)


A few initial points:


* We don't formally support OpenSAML for use as an independent library, only as part of our IdP product.

* I believe we looked at both of these issues and determined that they didn't affect the IdP product. We can't say whether they would affect yours.

* We didn't put that version of OpenSAML on Maven Central. Here's our policy regarding that:

   https://wiki.shibboleth.net/confluence/display/DEV/Use+of+Maven+Central

  We publish our own artifacts here, instead:

   https://build.shibboleth.net/nexus/

If you're going to use our artifacts, particularly security-related ones, I'd strongly advise getting them from us rather than from a third party.

* 3.4.5 is the latest version of the 3.x series, but that whole product line will be EOL soon and the thing our attention is on is therefore 4.x. Unless something is an actual security issue for our 3.x _product_, i.e., the IdP, you shouldn't expect us to address it today and after the end of the year you shouldn't expect it to be addressed _at all_.


>     Then I ran a vulnerability check and found that there are two known vulnerability in the dependencies: 
>     - org.cryptacular:cryptacular.    Denial of Service.    (Affected version: [1.0,1.1.4) || [1.2.0,1.2.4) ). (https://snyk.io/vuln/SNYK-JAVA-ORGCRYPTACULAR-543303)
>     - org.apache.santuario:xmlsec.     XML External Entity (XXE) Injection.   (Affected version: [2.0.3, 2.1.4) ). (https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-460281)


I will observe that we did a dependency refresh for the 4.0.1 version of our IdP product and it ships with later versions of these dependencies: cryptacular 1.2.4 and xmlsec 2.1.4, so both of these issues are covered there even though, as I say, I don't think they affect that product in practice.

Bottom line: no, those issues will not be addressed in the V3 line. They are already addressed in the V4 line, which you should be migrating to anyway.

I hope that helps.

    -- Ian




-------------- next part --------------
A non-text attachment was scrubbed...
Name: smime.p7s
Type: application/pkcs7-signature
Size: 3883 bytes
Desc: not available
URL: <http://shibboleth.net/pipermail/dev/attachments/20200617/44eeb462/attachment.p7s>