[
https://issues.apache.org/jira/browse/AXIS2C-1607?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel
]
Robert Lazarski resolved AXIS2C-1607.
-------------------------------------
Fix Version/s: (was: 1.7.0)
Resolution: Won't Fix
I may open this issue in the Axis2/Java sub project Rampart but this is
Axis2/Java and the wrong place.
CVE-2012-5351 applies to Apache Axis2/Java, not Axis2/C.
Evidence:
1. GitHub Advisory GHSA-66rx-gqx3-p98m explicitly lists affected package
as "maven org.apache.axis2:axis2" - the Java artifact
2. Fixed in Axis2/Java version 1.6.4
3. Axis2/C does not implement SAML signature verification - this is
delegated to Apache Rampart/C (a separate project)
4. The neethi module in Axis2/C only handles WS-SecurityPolicy parsing,
not actual cryptographic verification
If there is a vulnerability in SAML processing for the C stack, it would
need to be filed against Apache Rampart/C, not Axis2/C.
Closing as Not Applicable to Axis2/C.
> CVE-2012-5351 - "Signature exclusion attack," a different vulnerability than
> CVE-2012-4418
> ------------------------------------------------------------------------------------------
>
> Key: AXIS2C-1607
> URL: https://issues.apache.org/jira/browse/AXIS2C-1607
> Project: Axis2-C
> Issue Type: Bug
> Reporter: Brian Thomason
> Priority: Critical
>
> Common Vulnerabilities and Exposures assigned an identifier CVE-2012-5351 to
> the following vulnerability:
> Name: CVE-2012-5351
> URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5351
> Assigned: 20121009
> Reference:
> http://www.nds.rub.de/media/nds/veroeffentlichungen/2012/08/22/BreakingSAML_3.pdf
> Apache Axis2 allows remote attackers to forge messages and bypass
> authentication via a SAML assertion that lacks a Signature element,
> aka a "Signature exclusion attack," a different vulnerability than
> CVE-2012-4418.
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
