InCommon Operations Notifications

[Shannon Roddy <>]

Hello,

We are contacting you in order to raise awareness of a critical security
issue.  The problem is a general issue with the way XML is processed by
many XML libraries and the associated tooling.  Many recipients of this
email will primarily be concerned with this vulnerability due to
Shibboleth being affected, however this is not just a Shibboleth
problem.  It is possible and/or likely that other vulnerabilities
related to this will continue to be discovered.

Several CVEs are associated with work by Duo Security [1] researchers in
relation to this bug:

OneLogin - python-saml - CVE-2017-11427
OneLogin - ruby-saml - CVE-2017-11428
Clever - saml2-js - CVE-2017-11429
OmniAuth-SAML - CVE-2017-11430
Shibboleth - CVE-2018-0489
Duo Network Gateway - CVE-2018-7340

SimpleSAMLphp also released a security update today related to XML
signatures, however details are under embargo on their web site [2] at
this time.

It is not currently known whether or not PySAML2 is affected, but we are
making inquiries and will update you when we find out more.  For the
moment, there is an ongoing thread in relation to this [5].

On February 27th, the Shibboleth Consortium released a critical security
advisory [3], and a followup to that advisory [4].  The vulnerability is
of greatest concern to Service Providers.  In many cases, the
administrators operating these Service Providers may not be subscribed
to channels through which they would see these advisories.  It is
important that operators of Service Providers patch for this
vulnerability, and if they would not otherwise be aware of this problem,
that this information be urgently shared with them.

Thank You,
Shannon Roddy
Security Lead, Trust & Identity


[1]
https://duo.com/blog/duo-finds-saml-vulnerabilities-affecting-multiple-implementations
[2] https://simplesamlphp.org/docs/stable/simplesamlphp-changelog#section_1
[3] https://marc.info/?l=shibboleth-announce&m=151974009716308&w=2
[4] https://marc.info/?l=shibboleth-announce&m=151974367617676&w=2
[5] https://github.com/IdentityPython/pysaml2/issues/497