security-services message

Subject: Re: [security-services] Fwd: SAML Security Bypass

From: "Cantor, Scott" <cantor.2@osu.edu>
To: Chet Ensign <chet.ensign@oasis-open.org>, "SAML (security-services@lists.oasis-open.org)" <security-services@lists.oasis-open.org>
Date: Mon, 6 Jul 2020 18:48:26 +0000

On 7/6/20, 2:42 PM, "security-services@lists.oasis-open.org on behalf of Chet Ensign" <security-services@lists.oasis-open.org on behalf of chet.ensign@oasis-open.org> wrote:

> The actual vulnerability appears to be in the PAN-OS software itself when using a particular configuration of SAML. It
> doesn't seem to present a vulnerability in the spec itself. 

Not unless we consider "programmers with no business implementing security standards" a vulnerability. Unfortunately that one's not going away.

-- Scott

References:
- Fwd: SAML Security Bypass
  - From: Chet Ensign <chet.ensign@oasis-open.org>