As of 7.11 Drupal core implements a fix for CVE: CVE-2012-0825. AX values on the relying party side are ignored. See: http://drupal.org/node/1425084.

The provided patch solves this issue.

CommentFileSizeAuthor
#3 1485036_openidax_properly_sign_3.patch1.02 KBslashrsm
#2 1485036_openidax_properly_sign_2.patch1.04 KBslashrsm
properly_sign_ax_value.patch540 bytesparanojik

Comments

paranojik’s picture

paranojik commented
Status: Active » Needs review

Forgot to change status...

slashrsm’s picture

slashrsm commented
StatusFileSize
new 1485036_openidax_properly_sign_2.patch1.04 KB

A bit improved patch.

slashrsm’s picture

slashrsm commented
StatusFileSize
new 1485036_openidax_properly_sign_3.patch1.02 KB

This should be even better.

xamanu’s picture

xamanu commented
Status: Needs review » Fixed

Committed. Thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

mgeurts’s picture

mgeurts commented

Xamanu, i'm looking at this at the moment, using:

test-id.net to test this and i'm still getting an "Warning: Provider failed to sign the AX extension." after applying this patch. Any thoughts?

jerry.johnson’s picture

jerry.johnson commented
Issue summary: View changes
Status: Closed (fixed) » Active

I've tried the patches and the latest commit 7.x-1.x-dev. The attributes such as mode are not being signed still. I've confirmed with fiddler, as well.