Significant OpenSAML advisories/patches

[Peter Schober]

Cantor, Scott via alert <alert at shibboleth.net> [2025-03-11 02:06 CET]:
> We received a credible vulnerability report for both OpenSAML
> libraries today involving signature bypass attacks leveraging the
> non-XML signature features used in the Redirect and POST-SimpleSign
> bindings (yes, ironically, not XML-based signing).

Heh, that's indeed curious.  Given that I've never actually seen
POST-SimpleSign being used in the wild (and in my small part of the
world the AuthnRequest typically doesn't contain anything worth
protecting, so I'm not worried about signatures there) is there
anything deployers should do, e.g. disable POST-SimpleSign in their
systems?
Commenting out the protocol binding in /etc/shibboleth/protocols.xml
seems to do the trick for the SP (as I'm guessing would removing the
PolicyRule/@type="SimpleSigning" from /security-policy.xml).

Removing the endpoint from federation metadata would be quick and
painless (since I claim that those are not actually being used, not
even between a Shib SP and Shib IDP, unless specifically configuired)
but doesn't protect the actual endpoints, of course. Merely removing
the announcement won't do much to protect from targeted (or drive-by)
attempts, of course.

-peter