Spring Security SAML and this week's SAML Vulnerability
This week, the software world found out that SAML Vulnerabilities Affecting Multiple Implementations were discovered. If you use Spring Security SAML’s defaults, you are not impacted by this vulnerability.
The underlying implementation that Spring Security SAML uses is Shibboleth’s OpenSAML Java library. The OpenSAML Java implementation was not listed in the libraries that contain the vulnerability (Shibboleth openSAML C++ was vulnerable). However, if the ParserPool
has been customized, you may be impacted.
NOT Safe Configurations
Specifically, if the application explicitly sets the BasicParserPool
or the StaticBasicParserPool
to have ignoreComments = false
, it is vulnerable to the…