—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2023.3855
php-cas security update
10 July 2023
===========================================================================
AusCERT Security Bulletin Summary
———————————
Product: php-cas
Publisher: Debian
Operating System: Debian GNU/Linux
Resolution: Patch/Upgrade
CVE Names: CVE-2022-39369
Original Bulletin:
https://lists.debian.org/debian-lts-announce/2023/07/msg00007.html
Comment: CVSS (Max): 8.0 CVE-2022-39369 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H)
CVSS Source: NVD
Calculator: https://www.first.org/cvss/calculator/3.1#CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
– ————————–BEGIN INCLUDED TEXT——————–
– ————————————————————————-
Debian LTS Advisory DLA-3485-1 [email protected]
https://www.debian.org/lts/security/ Tobias Frost
July 08, 2023 https://wiki.debian.org/LTS
– ————————————————————————-
Package : php-cas
Version : 1.3.6-1+deb10u1
CVE ID : CVE-2022-39369
Debian Bug : 1023571
A vulnerability has been found in phpCAS, a Central Authentication
Service client library in php, which may allow an attacker to gain
access to a victim’s account on a vulnerable CASified service without
victim’s knowledge, when the victim visits attacker’s website while
being logged in to the same CAS server.
The fix for this vulnerabilty requires an API breaking change in php-cas
and will require that software using the library be updated.
For buster, all packages in the Debian repositories which are using
php-cas have been updated, though additional manual configuration is to
be expected, as php-cas needs additional site information — the service
base URL — for it to function. The DLAs for the respective packages
will have additional information, as well as the package’s NEWS files.
For 3rd party software using php-cas, please be note that upstream
provided following instructions how to update this software [1]:
phpCAS now requires an additional service base URL argument when constructing
the client class. It accepts any argument of:
1. A service base URL string. The service URL discovery will always use this
server name (protocol, hostname and port number) without using any external
host names.
2. An array of service base URL strings. The service URL discovery will check
against this list before using the auto discovered base URL. If there is no
match, the first base URL in the array will be used as the default. This
option is helpful if your PHP website is accessible through multiple domains
without a canonical name, or through both HTTP and HTTPS.
3. A class that implements CAS_ServiceBaseUrl_Interface. If you need to
customize the base URL discovery behavior, you can pass in a class that
implements the interface.
Constructing the client class is usually done with phpCAS::client().
For example, using the first possiblity:
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context);
could become:
phpCAS::client(CAS_VERSION_2_0, $cas_host, $cas_port, $cas_context,
“https://casified-service.example.org:8080”);
Details of the vulnerability:
CVE-2022-39369
The phpCAS library uses HTTP headers to determine the service URL used
to validate tickets. This allows an attacker to control the host header
and use a valid ticket granted for any authorized service in the same
SSO realm (CAS server) to authenticate to the service protected by
phpCAS. Depending on the settings of the CAS server service registry in
worst case this may be any other service URL (if the allowed URLs are
configured to “^(https)://.*”) or may be strictly limited to known and
authorized services in the same SSO federation if proper URL service
validation is applied.
For Debian 10 buster, this problem has been fixed in version
1.3.6-1+deb10u1.
We recommend that you upgrade your php-cas packages.
For the detailed security status of php-cas please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/php-cas
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
– —–BEGIN PGP SIGNATURE—–
iQIzBAABCAAdFiEE/d0M/zhkJ3YwohhskWT6HRe9XTYFAmSpbL0ACgkQkWT6HRe9
XTbD2xAAyk+Y7Ac0Z9VdB+njbAOR7j2XwtUKqJr0N3pXFUkDZMR552MTRQKiYDme
3tR+b8Zz7nP0xmSCit2503BTNUfM7aSccB2PtFVpT6U09wCH7LbfovXr+mPpVv7w
ip1bjBJ85mo0MT5jYpGJ07aD+oYBzYyPyKg+nTu3LInNj33KK9DbHpH4qmM9DYYu
wU0qfPdBi+D989qrdXJrAjNtBeRbKsUDZ/A6MIW0wJMelH0SLAzJseuRVOpMGTxM
Ivk6nrpL0MlN7zG9vFYranztrqWaERCdaPf3hKAtRxCF8u3CySU6qzqTRxAN1VM/
mLjaUbaNwPyazN4ENNQjk4OjvwOw7FUlgKQmB13mn+hgiN913zjYbsMPdO74dFK7
xS1V6Gv/EirfN2Pou/TN8hUXabejiYscwEc1S12iVHiu+HmYF0w+dYrtjww+/iTB
xfTdKuDAjR8KNVXd2yajlVgwMPaC3hE1Y6/J8CYK4LnFkdMXDX+DYFhfQW0Eace5
2LLH0pkbYzDAbQPUwRUp0euvQBj7/KJ3upeYhU2fwuEi2amzrYu/wnWftxS/21GX
4pnPiI5kmPXLZqSmPZ96ffr+iDszc5DPBon71H2wUmagTXrQrGX2MOGMUMtJfyk5
g6NDzuyW4WYodfCJsJ0bzBUvBsbjCwGxDHe33W0dCGeVDD5BGEA=
=OjEd
– —–END PGP SIGNATURE—–
– ————————–END INCLUDED TEXT——————–
You have received this e-mail bulletin as a result of your organisation’s
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to [email protected]
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT’s members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation’s
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author’s website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: [email protected]
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
—–BEGIN PGP SIGNATURE—–
Comment: https://auscert.org.au/gpg-key/
iQIVAwUBZKt0nckNZI30y1K9AQjVuA/+M1eYJZ2B8WaM7x7Jver0PnRf7dTp8kMN
9ifVyio6TYEywA7VBzXOFwIs3pmdQq2eSpB3RXOCklJXTztXV8+0G/m4VXXcz/se
YZfsnCh2XPdeKcowU6zfWUh/3CROEx65+7QuCRoorwWRnlQweY45lshHdLumN9Dr
Av6t2sVEjzHrroAVFXhLshYb8Vw766dOgQZUfxDJ49OdEnplCDxbm25eZHPC0NnY
NzVbprSdZ59ejZwZ8F/B+TwNJ5DAouQGBsDSwRezHCt8l0eRvFgCYrnwBuUwWW6C
rr9gh7kug1rzZc54qm4kHyZvPmbXmXpaUd38VZEr9vYlTbWmpBI6SVRSzZ8f/ecX
oRCTuj3DPNEgd2jpiviqcMW1LbCsO3PrAsjnSETiOQdclovIzntqSyi45x300ZxF
gQjmSKUw9e121oOAejKaBEMmQqNLaFlRzu8qyt8Z/MIWbaTp9+CmIJhH9oqERdSl
6EyFpiyP9OOInYfwLOgbjuqako5ajq5BcCF4+Q26JGe2atKe6kJKHJQDLw/FAjZf
PF5ZkFVUlmayRg/w7xKEMQgaiaM9FCm1tdgo70JnxdnpFdoCCRHrQ9sgZiTVP7KN
BmOU22L2pTc1cD97RFIvxnNj01/ONt/B/xzg7XvrRYnKLIsyTLkiC3oAeYw2CNLA
V0pW05z63Jk=
=Nutk
—–END PGP SIGNATURE—–
Source: Read More
Security Bulletins