Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.opensaml/opensaml@2.6.4
purl pkg:maven/org.opensaml/opensaml@2.6.4
Next non-vulnerable version None.
Latest non-vulnerable version None.
Risk 3.1
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-grv5-69mv-5fdr
Aliases:
CVE-2015-1796
GHSA-78fq-w796-q537
Improper Certificate Validation in Shibboleth Identity Provider and OpenSAML The PKIX trust engines in Shibboleth Identity Provider before 2.4.4 and OpenSAML Java (OpenSAML-J) before 2.6.5 trust candidate X.509 credentials when no trusted names are available for the entityID, which allows remote attackers to impersonate an entity via a certificate issued by a shibmd:KeyAuthority trust anchor.
2.6.5
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-2r1u-v64e-jbbw Improper Validation of Certificate with Host Mismatch The (1) `HttpResource` and (2) `FileBackedHttpResource` implementations in OpenSAML do not verify that the server hostname matches a domain name in the subject's Common Name (CN) or `subjectAltName` field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate. CVE-2014-3603
GHSA-rm7v-gqfg-p2wc

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-16T21:52:29.621768+00:00 GitLab Importer Affected by VCID-grv5-69mv-5fdr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2015-1796.yml 38.4.0
2026-04-16T20:53:20.226294+00:00 GitLab Importer Fixing VCID-2r1u-v64e-jbbw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2014-3603.yml 38.4.0
2026-04-11T23:08:13.423692+00:00 GitLab Importer Affected by VCID-grv5-69mv-5fdr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2015-1796.yml 38.3.0
2026-04-11T22:04:10.255092+00:00 GitLab Importer Fixing VCID-2r1u-v64e-jbbw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2014-3603.yml 38.3.0
2026-04-04T14:31:30.448270+00:00 GHSA Importer Affected by VCID-grv5-69mv-5fdr https://github.com/advisories/GHSA-78fq-w796-q537 38.1.0
2026-04-02T23:16:43.641496+00:00 GitLab Importer Affected by VCID-grv5-69mv-5fdr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2015-1796.yml 38.1.0
2026-04-02T22:17:09.452873+00:00 GitLab Importer Fixing VCID-2r1u-v64e-jbbw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2014-3603.yml 38.1.0
2026-04-01T16:34:47.900106+00:00 GitLab Importer Fixing VCID-2r1u-v64e-jbbw https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2014-3603.yml 38.0.0
2026-04-01T12:50:42.463725+00:00 GitLab Importer Affected by VCID-grv5-69mv-5fdr https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.opensaml/opensaml/CVE-2015-1796.yml 38.0.0