SAML Vulnerability Note VU#475445 - Is Spring Secucity SAML2 affected?

Question

https://www.kb.cert.org/vuls/id/475445 has just been disclosed.

Is this impacting Spring Security SAML2?

I can't see the XML parser used on Spring Security SAML2 on the list of affected APIs.

Let us know.

Answer 1

I am the Spring Security project lead and I have verified that the exploit does not work against Spring Security SAML with the default settings. This was verified by a colleague as well.

If you change the default settings (set ignoreComments = false), your application becomes vulnerable.

Update: See https://spring.io/blog/2018/03/01/spring-security-saml-and-this-week-s-saml-vulnerability