Skip to content

Commit aa86c3c

Browse files
dependabot[bot]maximthomas
dependabot[bot]
and
maximthomas
authored
CVE-2018-8039 Apache CXF TLS hostname verification does not work correctly with com.sun.net.ssl.* (#871)
Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: maximthomas <[email protected]>
1 parent efc97d4 commit aa86c3c

File tree

33 files changed

+169
-108
lines changed

33 files changed

+169
-108
lines changed

‎openam-sts/openam-soap-sts/openam-soap-sts-client/src/main/java/org/forgerock/openam/sts/soap/SoapSTSConsumer.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap;
@@ -31,9 +32,9 @@
3132
import org.apache.cxf.ws.security.tokenstore.SecurityToken;
3233
import org.apache.cxf.ws.security.trust.STSClient;
3334
import org.apache.cxf.ws.security.trust.TrustException;
34-
import org.apache.ws.security.WSSecurityException;
35-
import org.apache.ws.security.components.crypto.Crypto;
36-
import org.apache.ws.security.components.crypto.CryptoFactory;
35+
import org.apache.wss4j.common.ext.WSSecurityException;
36+
import org.apache.wss4j.common.crypto.Crypto;
37+
import org.apache.wss4j.common.crypto.CryptoFactory;
3738
import org.forgerock.openam.sts.AMSTSConstants;
3839
import org.forgerock.openam.sts.soap.policy.am.OpenAMSessionTokenClientAssertionBuilder;
3940
import org.forgerock.openam.sts.soap.policy.am.OpenAMSessionTokenClientInterceptorProvider;

‎openam-sts/openam-soap-sts/openam-soap-sts-client/src/main/java/org/forgerock/openam/sts/soap/SoapSTSConsumerCallbackHandler.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,12 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap;
1819

19-
import org.apache.ws.security.WSPasswordCallback;
20+
import org.apache.wss4j.common.ext.WSPasswordCallback;
2021

2122
import javax.security.auth.callback.Callback;
2223
import javax.security.auth.callback.CallbackHandler;

‎openam-sts/openam-soap-sts/openam-soap-sts-client/src/main/java/org/forgerock/openam/sts/soap/TokenSpecification.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,16 +12,17 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015-2016 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap;
1819

1920
import static org.forgerock.openam.utils.Time.*;
2021

21-
import org.apache.cxf.ws.security.policy.SP12Constants;
22-
import org.apache.cxf.ws.security.policy.SPConstants;
23-
import org.apache.ws.security.WSConstants;
24-
import org.apache.ws.security.message.WSSecUsernameToken;
22+
import org.apache.wss4j.policy.SP12Constants;
23+
import org.apache.wss4j.policy.SPConstants;
24+
import org.apache.wss4j.dom.WSConstants;
25+
import org.apache.wss4j.dom.message.WSSecUsernameToken;
2526
import org.forgerock.openam.sts.AMSTSConstants;
2627
import org.forgerock.openam.sts.soap.policy.am.OpenAMSessionAssertion;
2728
import org.w3c.dom.Document;
@@ -185,7 +186,7 @@ public static Element openAMSessionTokenOnBehalfOfElement(String sessionId) {
185186
type is generated
186187
*/
187188
Element nestedPolicyElement = null;
188-
return new OpenAMSessionAssertion(SP12Constants.INSTANCE, SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT,
189+
return new OpenAMSessionAssertion(SPConstants.SPVersion.SP12, SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT,
189190
nestedPolicyElement, sessionId).getTokenElement();
190191
}
191192
}

‎openam-sts/openam-soap-sts/openam-soap-sts-client/src/main/java/org/forgerock/openam/sts/soap/policy/am/OpenAMSessionTokenClientAssertionBuilder.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,13 +12,14 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap.policy.am;
1819

1920
import org.apache.cxf.ws.policy.PolicyConstants;
20-
import org.apache.cxf.ws.security.policy.SP12Constants;
21-
import org.apache.cxf.ws.security.policy.SPConstants;
21+
import org.apache.wss4j.policy.SP12Constants;
22+
import org.apache.wss4j.policy.SPConstants;
2223
import org.forgerock.openam.sts.soap.OpenAMSessionTokenCallback;
2324
import org.apache.neethi.Assertion;
2425
import org.apache.neethi.AssertionBuilderFactory;
@@ -72,7 +73,7 @@ public Assertion build(Element element, AssertionBuilderFactory assertionBuilder
7273
throw new IllegalStateException("CallbackHandler registered with OpenAMSessionTokenClientAssertionBuilder " +
7374
"cannot handle OpenAMSessionTokenCallback: " + e, e);
7475
}
75-
return new OpenAMSessionAssertion(SP12Constants.INSTANCE, SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT,
76+
return new OpenAMSessionAssertion(SPConstants.SPVersion.SP12, SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT,
7677
nestedPolicyElement, ((OpenAMSessionTokenCallback)callbacks[0]).getSessionId());
7778
}
7879

‎openam-sts/openam-soap-sts/openam-soap-sts-client/src/main/java/org/forgerock/openam/sts/soap/policy/am/OpenAMSessionTokenClientInterceptor.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap.policy.am;
@@ -20,8 +21,8 @@
2021
import org.apache.cxf.headers.Header;
2122
import org.apache.cxf.ws.policy.AssertionInfo;
2223
import org.apache.cxf.ws.policy.AssertionInfoMap;
23-
import org.apache.cxf.ws.security.policy.SP12Constants;
24-
import org.apache.cxf.ws.security.policy.model.Token;
24+
import org.apache.wss4j.policy.SP12Constants;
25+
import org.apache.wss4j.policy.model.AbstractToken;
2526
import org.forgerock.openam.sts.AMSTSConstants;
2627
import org.w3c.dom.Element;
2728

@@ -69,12 +70,12 @@ protected void addToken(SoapMessage message) {
6970
* soap-sts instances.
7071
*/
7172
@Override
72-
protected Token assertTokens(SoapMessage message) {
73+
protected AbstractToken assertTokens(SoapMessage message) {
7374
AssertionInfoMap aim = message.get(AssertionInfoMap.class);
7475
Collection<AssertionInfo> ais = aim.getAssertionInfo(AMSTSConstants.AM_SESSION_TOKEN_ASSERTION_QNAME);
75-
Token token = null;
76+
AbstractToken token = null;
7677
for (AssertionInfo ai : ais) {
77-
token = (Token)ai.getAssertion();
78+
token = (AbstractToken)ai.getAssertion();
7879
ai.setAsserted(true);
7980
}
8081
ais = aim.getAssertionInfo(SP12Constants.SUPPORTING_TOKENS);

‎openam-sts/openam-soap-sts/openam-soap-sts-server/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@
4343
</build>
4444

4545
<properties>
46-
<cxf.version>2.7.18</cxf.version>
46+
<cxf.version>3.1.16</cxf.version>
4747
</properties>
4848

4949
<dependencies>

‎openam-sts/openam-soap-sts/openam-soap-sts-server/src/main/java/org/forgerock/openam/sts/soap/SoapSTSCallbackHandler.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,11 +12,12 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2013-2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap;
1819

19-
import org.apache.ws.security.WSPasswordCallback;
20+
import org.apache.wss4j.common.ext.WSPasswordCallback;
2021
import org.forgerock.openam.sts.AMSTSConstants;
2122

2223
import javax.security.auth.callback.Callback;

‎openam-sts/openam-soap-sts/openam-soap-sts-server/src/main/java/org/forgerock/openam/sts/soap/config/SoapSTSInstanceModule.java‎

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2013-2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap.config;
@@ -34,10 +35,10 @@
3435
import org.apache.cxf.ws.security.sts.provider.operation.IssueOperation;
3536
import org.apache.cxf.ws.security.sts.provider.operation.ValidateOperation;
3637
import org.apache.cxf.ws.security.tokenstore.TokenStore;
37-
import org.apache.ws.security.WSSecurityException;
38-
import org.apache.ws.security.components.crypto.Crypto;
39-
import org.apache.ws.security.components.crypto.CryptoFactory;
40-
import org.apache.ws.security.message.token.UsernameToken;
38+
import org.apache.wss4j.common.ext.WSSecurityException;
39+
import org.apache.wss4j.common.crypto.Crypto;
40+
import org.apache.wss4j.common.crypto.CryptoFactory;
41+
import org.apache.wss4j.dom.message.token.UsernameToken;
4142
import org.forgerock.openam.sts.HttpURLConnectionWrapperFactory;
4243
import org.forgerock.openam.sts.TokenType;
4344
import org.forgerock.openam.sts.XMLUtilities;
@@ -263,7 +264,7 @@ private void processSecurityPolicyTokenValidatorConfiguration(Map<String, Object
263264
default:
264265
String message = "Unexpected TokenType in processSecurityPolicyTokenValidatorConfiguration: " + tokenType;
265266
logger.error(message);
266-
throw new WSSecurityException(message);
267+
throw new WSSecurityException(WSSecurityException.ErrorCode.UNSUPPORTED_SECURITY_TOKEN, message);
267268
}
268269
}
269270
/*

‎openam-sts/openam-soap-sts/openam-soap-sts-server/src/main/java/org/forgerock/openam/sts/soap/policy/am/OpenAMSessionAssertion.java‎

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,21 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap.policy.am;
1819

1920
import org.apache.cxf.helpers.DOMUtils;
20-
import org.apache.cxf.ws.security.policy.SP12Constants;
21-
import org.apache.cxf.ws.security.policy.model.Token;
22-
import org.apache.ws.security.message.token.BinarySecurity;
23-
import org.apache.cxf.ws.security.policy.SPConstants;
21+
import org.apache.cxf.ws.policy.PolicyBuilderImpl;
22+
import org.apache.neethi.Constants;
23+
import org.apache.neethi.Policy;
24+
import org.apache.neethi.PolicyBuilder;
25+
import org.apache.wss4j.policy.SP12Constants;
26+
import org.apache.wss4j.common.token.BinarySecurity;
27+
import org.apache.wss4j.policy.SPConstants;
28+
import org.apache.wss4j.policy.model.AbstractSecurityAssertion;
29+
import org.apache.wss4j.policy.model.AbstractToken;
2430
import org.forgerock.openam.sts.AMSTSConstants;
2531
import org.w3c.dom.Document;
2632
import org.w3c.dom.Element;
@@ -35,7 +41,7 @@
3541
* OpenAMSessionTokenClientAssertionBuilder registered with the org.apache.cxf.ws.policy.AssertionBuilderRegistry (obtained
3642
* via the cxf Bus) in the STSClient instance used to consume the OpenAM soap sts.
3743
*/
38-
public class OpenAMSessionAssertion extends Token {
44+
public class OpenAMSessionAssertion extends AbstractToken {
3945
private final String sessionId;
4046

4147
/**
@@ -54,12 +60,10 @@ public class OpenAMSessionAssertion extends Token {
5460
* OpenAMSessionTokenClientAssertionBuilder, and pulled from the BinarySecurityToken element which
5561
* encapsulates this sessionId when it arrives at the targeted sts.
5662
*/
57-
public OpenAMSessionAssertion(SPConstants version, SPConstants.IncludeTokenType includeTokenType, Element nestedPolicy, String sessionId) {
58-
super(version);
59-
setInclusion(includeTokenType);
63+
public OpenAMSessionAssertion(SPConstants.SPVersion version, SPConstants.IncludeTokenType includeTokenType, Element nestedPolicy, String sessionId) {
64+
super(version, includeTokenType, null, null, null, new PolicyBuilderImpl().getPolicy(nestedPolicy));
6065
setIgnorable(false);
6166
setOptional(false);
62-
setPolicy(nestedPolicy);
6367
this.sessionId = sessionId;
6468
}
6569

@@ -95,13 +99,15 @@ public void serialize(XMLStreamWriter writer) throws XMLStreamException {
9599
writer.writeNamespace(prefix, namespaceURI);
96100
writer.writeAttribute(prefix, namespaceURI, SPConstants.ATTR_INCLUDE_TOKEN, SP12Constants.INCLUDE_ALWAYS);
97101

98-
String pPrefix = writer.getPrefix(SPConstants.POLICY.getNamespaceURI());
102+
QName policy = Constants.Q_ELEM_POLICY_15;
103+
104+
String pPrefix = writer.getPrefix(policy.getNamespaceURI());
99105
if (pPrefix == null) {
100-
pPrefix = SPConstants.POLICY.getPrefix();
101-
writer.setPrefix(SPConstants.POLICY.getPrefix(), SPConstants.POLICY.getNamespaceURI());
106+
pPrefix = policy.getPrefix();
107+
writer.setPrefix(policy.getPrefix(), policy.getNamespaceURI());
102108
}
103109
// write start element of nested policy element
104-
writer.writeStartElement(pPrefix, SPConstants.POLICY.getLocalPart(), SPConstants.POLICY
110+
writer.writeStartElement(pPrefix, policy.getLocalPart(), policy
105111
.getNamespaceURI());
106112
// write end element of nested policy element
107113
writer.writeEndElement();
@@ -124,6 +130,11 @@ public Element getTokenElement() {
124130
return token.getElement();
125131
}
126132

133+
@Override
134+
protected AbstractSecurityAssertion cloneAssertion(Policy nestedPolicy) {
135+
return super.clone(nestedPolicy);
136+
}
137+
127138
/**
128139
* A private subclass of the wss4j BinarySecurityToken class, as an aid to obtain the xml corresponding to a
129140
* BinarySecurityToken necessary for inclusion in the soap security header by the OpenAMSessionTokenClientInterceptor.
@@ -140,7 +151,7 @@ private static class OpenAMSessionToken extends BinarySecurity {
140151
* @param sessionId The OpenAM session id to-be-included in the BST.
141152
*/
142153
void setSessionId(String sessionId) {
143-
getFirstNode().setData(sessionId);
154+
setRawToken(sessionId.getBytes());
144155
}
145156
}
146157
}

‎openam-sts/openam-soap-sts/openam-soap-sts-server/src/main/java/org/forgerock/openam/sts/soap/policy/am/OpenAMSessionTokenServerAssertionBuilder.java‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -12,15 +12,16 @@
1212
* information: "Portions Copyrighted [year] [name of copyright owner]".
1313
*
1414
* Copyright 2015 ForgeRock AS.
15+
* Portions Copyrighted 2025 3A-Systems LLC.
1516
*/
1617

1718
package org.forgerock.openam.sts.soap.policy.am;
1819
import org.apache.cxf.ws.policy.PolicyConstants;
19-
import org.apache.cxf.ws.security.policy.SP12Constants;
20+
import org.apache.wss4j.policy.SP12Constants;
2021
import org.apache.neethi.Assertion;
2122
import org.apache.neethi.AssertionBuilderFactory;
2223
import org.apache.neethi.builders.AssertionBuilder;
23-
import org.apache.cxf.ws.security.policy.SPConstants;
24+
import org.apache.wss4j.policy.SPConstants;
2425
import org.forgerock.openam.sts.AMSTSConstants;
2526

2627
import org.w3c.dom.Element;
@@ -45,7 +46,7 @@ public Assertion build(Element element, AssertionBuilderFactory assertionBuilder
4546
throw new IllegalArgumentException(AMSTSConstants.AM_SESSION_TOKEN_ASSERTION_QNAME
4647
+ " must have an inner wsp:Policy element");
4748
}
48-
return new OpenAMSessionAssertion(SP12Constants.INSTANCE, SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT,
49+
return new OpenAMSessionAssertion(SPConstants.SPVersion.SP12, SPConstants.IncludeTokenType.INCLUDE_TOKEN_ALWAYS_TO_RECIPIENT,
4950
nestedPolicyElement, element.getTextContent());
5051
}
5152

0 commit comments

Comments
 (0)