Is F5 SAML implementation in APM vulnerable to the recent authentication bypass attacks via incorrect XML canonicalization and DOM traversal?

Question

Hi all,&nbsp;
Duo Security has published several vulnerabilities on SAML implmentations, which apparently is related to XML canonicalization and DOM traversal.&nbsp;
Does anyone know if F5 implementation is vulnerable or not?&nbsp;
Regards &nbsp;

nav_126513 · Answer

Related CERT entry&nbsp;

amayle_299737 · Answer

I would also like to find out if the APM is affected. 
We utilise OKTA via the APM and although OKTA isn't vulnerable, I am unable to find any info on whether the APM is affected.&nbsp;

erik · Answer

Hi, F5 have make a comment on this. See K54462059&nbsp;

amayle_299737 · Answer

Thanks Erik.&nbsp;

Forum Discussion

Is F5 SAML implementation in APM vulnerable to the recent authentication bypass attacks via incorrect XML canonicalization and DOM traversal?

4 Replies

Recent Discussions

ltm policy asm_auto_l7_policy

MAC address not showing up in LLDP packet

F5Access | MacOS Sonoma

Active- Active HA setup

syslog server connection

Related Content

F5 BIG-IP Access Policy Manager (APM) - Google Authenticator and Microsoft Authenticator

CORS implementation

Implementing basic OAuth with F5 BIG-IP APM

API Security: How to implement API Access Control with F5

Implementing SSL Orchestrator with OPSWAT MetaDefender