PT-2017-9715 · Red Hat+1 · Ipsilon+2

Howard Johnson + 1 · Published 2016-11-21 · Updated 2023-02-12 · CVE-2016-8638

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions ipsilon versions 1.0 through 1.0.2 ipsilon versions 1.1 through 1.1.1 ipsilon versions 1.2 through 1.2.0 ipsilon versions 2.0 through 2.0.1

Description A issue was found that allows an attacker to log out active sessions of other users. This is related to how it tracks sessions, and allows an unauthenticated attacker to view and terminate active sessions from other users. It is also referred to as a "SAML2 multi-session" issue.

Recommendations For ipsilon versions 1.0 through 1.0.2, update to version 1.0.3 or later. For ipsilon versions 1.1 through 1.1.1, update to version 1.1.2 or later. For ipsilon versions 1.2 through 1.2.0, update to version 1.2.1 or later. For ipsilon versions 2.0 through 2.0.1, update to version 2.0.2 or later.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CESA-2016_2809

CVE-2016-8638

GHSA-376M-3RM2-9JM6

RHSA-2016:2809

RHSA-2016_2809

Affected Products

Centos

Red Hat

Ipsilon

References · 17

• https://nvd.nist.gov/vuln/detail/CVE-2016-8638 · Security Note
• http://rhn.redhat.com/errata/RHSA-2016-2809.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-376m-3rm2-9jm6 · Vendor Advisory
• https://pagure.io/ipsilon/c/511fa8b7001c2f9a42301aa1d4b85aaf170a461c · Vendor Advisory
• https://ipsilon-project.org/advisory/CVE-2016-8638.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-8638 · Vendor Advisory
• https://github.com/ipsilon-project/ipsilon · Note
• https://github.com/ipsilon-project/ipsilon/commit/a33303b6beb5c316d7c18b23566b7666a4e307a4 · Note
• https://github.com/ipsilon-project/ipsilon/commit/64fc366c054fc6af1d9d2692902db169884b5f78 · Note
• https://github.com/ipsilon-project/ipsilon/commit/b4744a92d4fa7f6d7ade0ae2d99a2dc0ea94734d · Note
• https://github.com/ipsilon-project/ipsilon/commit/1c48414877fc110652b6078a29529972c7ec9122 · Note
• https://ipsilon-project.org/release/2.1.0.html · Note
• http://securityfocus.com/bid/94439 · Note
• https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2016-8638 · Note
• https://access.redhat.com/security/cve/CVE-2016-8638 · Note