GCVE - cpe:2.3:a:shibboleth:identity_provider:*:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:shibboleth:identity_provider:*:*:*:*:*:*:*:*

part: a version: * update: *

Vendor	Shibboleth (`b8022daa-94b7-5177-897b-f4c767ed6d13`)
Product	Identity Provider (`51609bfc-7388-54a9-a4eb-2eac983857ed`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from purl2cpe mapping

PURL mappings

PURL	Source	Last updated
`pkg:maven/net.shibboleth.idp/idp-parent`	purl2cpe	2026-06-01 10:13:00.081932

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2020-27978`	vulnerable	2026-06-08 05:23:53.619117	Details available Shibboleth Identify Provider 3.x before 3.4.6 has a denial of service flaw. A remote unauthenticated attacker can cause a login flow to trigger Java heap exhaustion due to the creation of objects in the Java Servlet container session. Published: 2020-10-28T14:43:54.000Z Updated: 2024-08-04T16:25:44.145Z Open on db.gcve.eu Reference links https://shibboleth.net/community/advisories/secadv_20191002.txt	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-1796`	vulnerable	2026-06-08 05:06:26.295937	Details available The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor. Published: 2015-07-08T15:00:00.000Z Updated: 2024-08-06T04:54:16.257Z Open on db.gcve.eu Reference links http://rhn.redhat.com/errata/RHSA-2015-1176.html https://shibboleth.net/community/advisories/secadv_20150225.txt http://rhn.redhat.com/errata/RHSA-2015-1177.html http://www.securityfocus.com/bid/75370	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2014-3603`	vulnerable	2026-06-08 05:05:33.705780	Details available The (1) HttpResource and (2) FileBackedHttpResource implementations in Shibboleth Identity Provider (IdP) before 2.4.1 and OpenSAML Java 2.6.2 do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. Published: 2019-04-04T13:38:16.000Z Updated: 2024-08-06T10:50:17.020Z Open on db.gcve.eu Reference links http://secunia.com/advisories/60816 https://bugzilla.redhat.com/show_bug.cgi?id=1131823 http://shibboleth.net/community/advisories/secadv_20140813.txt	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.