PT-2015-6839 · Red Hat · Ipsilon

Patrick Uiterwijk + 1 · Published 2015-11-17 · Updated 2022-05-17 · CVE-2015-5301

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Ipsilon versions 0.1.0 through 1.0.1 Ipsilon versions 1.1.x prior to 1.1.1

Description The issue is related to improper permission checking in the providers/saml2/admin.py file of the Identity Provider (IdP) server. This allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).

Recommendations For Ipsilon versions 0.1.0 through 1.0.1, update to version 1.0.2 or later. For Ipsilon versions 1.1.x prior to 1.1.1, update to version 1.1.1 or later.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-5301

GHSA-9QP4-79Q8-58PR

PYSEC-2015-42

Affected Products

Ipsilon

References · 14

• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171076.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9qp4-79q8-58pr · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171052.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2015-5301 · Security Note
• https://osv.dev/vulnerability/PYSEC-2015-42 · Vendor Advisory
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171067.html · Vendor Advisory
• https://github.com/pypa/advisory-database/tree/main/vulns/ipsilon/PYSEC-2015-42.yaml · Note
• https://github.com/ipsilon-project/ipsilon · Note
• https://fedorahosted.org/ipsilon/wiki/Releases/v1.0.2 · Note
• https://github.com/advisories/GHSA-9qp4-79q8-58pr · Note
• https://fedorahosted.org/ipsilon/wiki/Releases/v1.1.1 · Note
• https://pagure.io/ipsilon/9dec97c3c83928d231ea10f4160523a13803e594 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1271530 · Note
• http://openwall.com/lists/oss-security/2015/10/27/8 · Note