Candidate: CVE-2014-3527
PublicDate: 2017-05-25 17:29:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3527
 https://jira.spring.io/browse/SEC-2688
 http://spring.io/blog/2014/08/15/cve-2014-3527-fixed-in-spring-security-3-2-5-and-3-1-7
Description:
 When using the CAS Proxy ticket authentication from Spring Security 3.1 to
 3.2.4 a malicious CAS Service could trick another CAS Service into
 authenticating a proxy ticket that was not associated. This is due to the
 fact that the proxy ticket authentication uses the information from the
 HttpServletRequest which is populated based upon untrusted information
 within the HTTP request. This means if there are access control
 restrictions on which CAS services can authenticate to one another, those
 restrictions can be bypassed. If users are not using CAS Proxy tickets and
 not basing access control decisions based upon the CAS Service, then there
 is no impact to users.
Ubuntu-Description:
Notes:
 sbeattie> java-spring-security 3.x only?
Bugs:
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H [9.8 CRITICAL]

Patches_libspring-security-2.0-java:
upstream_libspring-security-2.0-java: needs-triage
precise_libspring-security-2.0-java: ignored (reached end-of-life)
precise/esm_libspring-security-2.0-java: DNE (precise was needs-triage)
trusty_libspring-security-2.0-java: ignored (reached end-of-life)
trusty/esm_libspring-security-2.0-java: DNE (trusty was needs-triage)
vivid_libspring-security-2.0-java: ignored (reached end-of-life)
vivid/stable-phone-overlay_libspring-security-2.0-java: DNE
vivid/ubuntu-core_libspring-security-2.0-java: DNE
wily_libspring-security-2.0-java: ignored (reached end-of-life)
xenial_libspring-security-2.0-java: DNE
yakkety_libspring-security-2.0-java: DNE
zesty_libspring-security-2.0-java: DNE
artful_libspring-security-2.0-java: DNE
bionic_libspring-security-2.0-java: DNE
cosmic_libspring-security-2.0-java: DNE
disco_libspring-security-2.0-java: DNE
devel_libspring-security-2.0-java: DNE