PatchTheCVEpicketlink vulnerabilities and fixes
Recent CVEs affecting picketlink, with upgrade or downgrade steps. 3 tracked.
picketlink has 3 tracked vulnerabilities, 0 critical. A fixed release or vendor patch exists for 3. Most recent: 2015-08-26. Highest priority: CVE-2015-6254 (score 41/100).
- CVE-2015-6254 MEDIUM 6.0 UPGRADE The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that
- CVE-2015-3158 MEDIUM 4.0 UPGRADE The invokeNextValve function in identity/federation/bindings/tomcat/idp/AbstractIDPValve.java in PicketLink be
- CVE-2015-0277 MEDIUM 6.0 UPGRADE The Service Provider (SP) in PicketLink before 2.7.0 does not ensure that it is a member of an Audience elemen
FAQ
How do I fix picketlink vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is picketlink being exploited right now?
None of the tracked picketlink CVEs are on the CISA Known Exploited Vulnerabilities list at the moment. This is checked every 20 minutes.
Which picketlink CVE should I patch first?
CVE-2015-6254 currently ranks highest (41/100): The (1) Service Provider (SP) and (2) Identity Provider (IdP) in PicketLink before 2.7.0 does not ensure that .