PT-2015-7855 · Red Hat · Ipsilon

Published 2015-11-17 · Updated 2015-11-17

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions Ipsilon versions 0.1.0 through 1.0.1 Ipsilon versions 1.1.x prior to 1.1.1

Description The issue is related to improper permission checking in the providers/saml2/admin.py file of the Identity Provider (IdP) server. This allows remote authenticated users to cause a denial of service by deleting a SAML2 Service Provider (SP).

Recommendations For Ipsilon versions 0.1.0 through 1.0.1, update to version 1.0.2 or later. For Ipsilon versions 1.1.x prior to 1.1.1, update to version 1.1.1 or later.

Related Identifiers

PYSEC-2015-42

Affected Products

Ipsilon

References · 9

• https://osv.dev/vulnerability/PYSEC-2015-42 · Vendor Advisory
• https://fedorahosted.org/ipsilon/wiki/Releases/v1.0.2 · Note
• https://fedorahosted.org/ipsilon/wiki/Releases/v1.1.1 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171052.html · Note
• http://openwall.com/lists/oss-security/2015/10/27/8 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171067.html · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=1271530 · Note
• https://pagure.io/ipsilon/9dec97c3c83928d231ea10f4160523a13803e594 · Note
• http://lists.fedoraproject.org/pipermail/package-announce/2015-November/171076.html · Note