Security issue on Java OpenSaml Library

[Cris Rockwell]

MIN.
Thank you for posting the results of your security scan. Good reminder to
upgrade to V4. Much appreciated
C

On Wed, Jun 17, 2020, 6:09 AM MIN ZHU <minmin3772 at gmail.com> wrote:

> Hi shibboleth developers,
>
>     I am using opensaml-security-api Java lib in my project. As shown in
> MavenRepository, the latest version is 3.4.5. (
> https://mvnrepository.com/artifact/org.opensaml/opensaml-security-api/3.4.5
> )
>
>     Then I ran a vulnerability check and found that there are two known
> vulnerability in the dependencies:
>     - org.cryptacular:cryptacular.    Denial of Service.    (Affected
> version: [1.0,1.1.4) || [1.2.0,1.2.4) ). (
> https://snyk.io/vuln/SNYK-JAVA-ORGCRYPTACULAR-543303)
>     - org.apache.santuario:xmlsec.     XML External Entity (XXE)
> Injection.   (Affected version: [2.0.3, 2.1.4) ). (
> https://snyk.io/vuln/SNYK-JAVA-ORGAPACHESANTUARIO-460281)
>
>     This is dependency tree of opensaml-security-api:
>
>         +- org.opensaml:opensaml-security-api:jar:3.4.5:compile
>         |  +- org.opensaml:opensaml-core:jar:3.4.5:compile
>         |  |  +- joda-time:joda-time:jar:2.9:compile
>         |  |  \- io.dropwizard.metrics:metrics-core:jar:4.1.7:compile
>         |  +- org.opensaml:opensaml-messaging-api:jar:3.4.5:compile
>         |  +- org.apache.santuario:xmlsec:jar:2.0.10:compile
>         |  |  \- com.fasterxml.woodstox:woodstox-core:jar:5.0.3:compile
>         |  |     \- org.codehaus.woodstox:stax2-api:jar:3.1.4:compile
>         |  +- org.cryptacular:cryptacular:jar:1.1.3:compile
>         |  +- net.shibboleth.utilities:java-support:jar:7.5.1:compile
>         |  \- commons-codec:commons-codec:jar:1.14:compile
>
>     May I know if you had any plan on these security issues?
>
>     Thank you for your great work !
>
> Best regards, MIN
> --
> To unsubscribe from this list send an email to
> dev-unsubscribe at shibboleth.net
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/dev/attachments/20200617/809f4af3/attachment.htm>