CVE-2014-5059 Security Context chaining allows arbitrary username assertion

Description

Chaining security context is defective such that where certain security contexts are chained in a certain way, users can log in as arbitrary users through trivial URL manipulation.

Environment

None

Activity

Show:
Andrew Petro
July 29, 2014, 9:33 PM

Reserved CVE-2014-5059 for this vulnerability.

Andrew Petro
August 21, 2014, 1:27 PM
Andrew Wills
September 9, 2014, 5:26 PM

@apetro – Isn't this ticket finished?

Andrew Petro
September 10, 2014, 4:25 PM

I left it open to remind me to triple-check that this is resolved in `master` , where I wasn't doing testing in the release engineering process, and to take a pass through the not-in-source-control wiki documentation to ensure that the examples there aren't encouraging folks to get back to an insecure configuration. Probably need big fat warnings in the wiki documentation. Here, I'll create a couple subtasks so the remaining things to do aren't just in my head.

Andrew Wills
October 31, 2014, 9:17 PM

task and subtasks done.

Assignee

Andrew Petro

Reporter

Andrew Wills

Labels

Estimated End Date

None

Components

Fix versions

Priority

Blocker
Configure