The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth…
Priority LOW 28CWE-297Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.
Why it matters now
EPSS 0.00844 58th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial Identity Provider (IdP) (Shibboleth; OpenSAML Java): 2.4.1OpenSAML Java (Shibboleth; OpenSAML Java): 2.6.2+2 more productsRed Hat: 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Shibboleth; OpenSAML Java | Identity Provider (IdP) | before 2.4.1 | 2.4.1 | Patch available | CNA |
| Shibboleth; OpenSAML Java | OpenSAML Java | before 2.6.2 | 2.6.2 | Patch available | CNA |
| — | edu.internet2.middleware:shibboleth-identityprovider (Maven) | before 2.4.1 | 2.4.1 | Patch available | GHSA-rm7v-gqfg-p2wc |
| — | org.opensaml:opensaml (Maven) | before 2.6.2 | 2.6.2 | Patch available | GHSA-rm7v-gqfg-p2wc |
- Identity Provider (IdP) VendorShibboleth; OpenSAML Java Affected before 2.4.1 Fixed in 2.4.1 Patch available CNA
- OpenSAML Java VendorShibboleth; OpenSAML Java Affected before 2.6.2 Fixed in 2.6.2 Patch available CNA
- edu.internet2.middleware:shibboleth-identityprovider (Maven) Vendor— Affected before 2.4.1 Fixed in 2.4.1 Patch available GHSA-rm7v-gqfg-p2wc
- org.opensaml:opensaml (Maven) Vendor— Affected before 2.6.2 Fixed in 2.6.2 Patch available GHSA-rm7v-gqfg-p2wc
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:shibboleth:identity_provider:*:*:*:*:*:*:*:* | before 2.4.1 | Vulnerable | Shibboleth |
| cpe:2.3:a:shibboleth:opensaml_java:*:*:*:*:*:*:*:* | before 2.6.2 | Vulnerable | Shibboleth |
- cpe:2.3:a:shibboleth:identity_provider:*:*:*:*:*:*:*:* Versions before 2.4.1 Vulnerable ·Shibboleth
- cpe:2.3:a:shibboleth:opensaml_java:*:*:*:*:*:*:*:* Versions before 2.6.2 Vulnerable ·Shibboleth
Remediation
- Fix · CNA Identity Provider (IdP) (Shibboleth; OpenSAML Java) Fixed in 2.4.1
- Fix · CNA OpenSAML Java (Shibboleth; OpenSAML Java) Fixed in 2.6.2
- Fix · GHSA-rm7v-gqfg-p2wc edu.internet2.middleware:shibboleth-identityprovider (Maven) Fixed in 2.4.1 Advisory →
- Fix · GHSA-rm7v-gqfg-p2wc org.opensaml:opensaml (Maven) Fixed in 2.6.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat JBoss Portal 5 | Affected | No fix planned: Will not fix |
Not affected: 6 products
- Red Hat JBoss Data Grid 6
- Red Hat JBoss Data Virtualization 6
- Red Hat JBoss Enterprise Application Platform 5
- Red Hat JBoss Enterprise Application Platform 6
- Red Hat JBoss Operations Network 3
- Red Hat JBoss Portal 6
Timeline
- 2026-10-02 Threatist record created from CVE-2014-3603
- 2026-10-03 Alias added: GHSA-rm7v-gqfg-p2wc
References
More Shibboleth Identity Provider vulnerabilities
- TI-2020-17017 Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. CVSS 3.1HIGH 7.5
- TI-2015-01614 The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java… CVSS 2.0MEDIUM 4.3
Sources
- CVE-2014-3603 · CVE Program
- CVE-2014-3603 · NVD
- FIRST EPSS
- GHSA-rm7v-gqfg-p2wc · GitHub Advisory Database · CC BY 4.0
- CVE-2014-3603 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences