<html><body><div style="font-family: arial, helvetica, sans-serif; font-size: 12pt; color: #000000"><div data-marker="__QUOTED_TEXT__"><div style=""><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><span style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;" data-mce-style="color: #000000; font-family: arial, helvetica, sans-serif; font-size: 16px; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; white-space: normal; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; background-color: #ffffff; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial; display: inline !important; float: none;">Dear midPoint community,</span><div style="clear: both;" data-mce-style="clear: both;"><span style="font-size: 12pt;">we issued three new security advisories for midPoint prior to versions 4.4.5, 4.6.1 and 4.7.1 and recommend you to update to the latest midPoint maintenance releases.</span><br></div></div><br><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;">These zero-day vulnerabilities does not affect most of midPoint deployments, affected features are not enabled by default, but please take time to learn if you may be affected.<br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br data-mce-bogus="1"></div><div style=""><div style="">Disabled MidPoint users able to log-in when LDAP authentication is enabled (Medium severity, all versions except 4.4.5, 4.6.1, 4.7.1)</div><div style=""><a href="https://docs.evolveum.com/midpoint/reference/security/advisories/015-disabled-users-able-to-log-in-with-ldap/">https://docs.evolveum.com/midpoint/reference/security/advisories/015-disabled-users-able-to-log-in-with-ldap/</a></div><div style="">User which is disabled in midPoint, but enabled in LDAP is able to log-in into midPoint if LDAP authentication is enabled.</div><div style=""><br></div><div style="">Unauthorized user is able to reset password if focusIdentification is enabled (High severity, only 4.7)</div><div style=""><a href="https://docs.evolveum.com/midpoint/reference/security/advisories/016-unauth-user-is-able-to-reset-password/">https://docs.evolveum.com/midpoint/reference/security/advisories/016-unauth-user-is-able-to-reset-password/</a></div><div style="">Attacker is able to skip password reset verification steps by manipulating URL if focusIdentification module is enabled.</div><div style=""><br></div><div style="">Self Registration feature allows to change password of other users (High severity, all versione except 4.4.5, 4.6.1, 4.7.1)</div><div style=""><a href="https://docs.evolveum.com/midpoint/reference/security/advisories/017-self-registration-allows-to-change-password/">https://docs.evolveum.com/midpoint/reference/security/advisories/017-self-registration-allows-to-change-password/</a></div><div style="">Attacker is able to disable and/or change password of other user by URL manipulation of post registration form.</div></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><br><br></div><div style="color: rgb(0, 0, 0); font-family: arial, helvetica, sans-serif; font-size: 12pt;"><pre style="--tw-border-spacing-x: 0; --tw-border-spacing-y: 0; --tw-translate-x: 0; --tw-translate-y: 0; --tw-rotate: 0; --tw-skew-x: 0; --tw-skew-y: 0; --tw-scale-x: 1; --tw-scale-y: 1; --tw-scroll-snap-strictness: proximity; --tw-ring-offset-width: 0px; --tw-ring-offset-color: #fff; --tw-ring-color: rgb(59 130 246 / 0.5); --tw-ring-offset-shadow: 0 0 #0000; --tw-ring-shadow: 0 0 #0000; --tw-shadow: 0 0 #0000; --tw-shadow-colored: 0 0 #0000; white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;" data-mce-style="--tw-border-spacing-x: 0; --tw-border-spacing-y: 0; --tw-translate-x: 0; --tw-translate-y: 0; --tw-rotate: 0; --tw-skew-x: 0; --tw-skew-y: 0; --tw-scale-x: 1; --tw-scale-y: 1; --tw-scroll-snap-strictness: proximity; --tw-ring-offset-width: 0px; --tw-ring-offset-color: #fff; --tw-ring-color: rgb(59 130 246 / 0.5); --tw-ring-offset-shadow: 0 0 #0000; --tw-ring-shadow: 0 0 #0000; --tw-shadow: 0 0 #0000; --tw-shadow-colored: 0 0 #0000; white-space: pre-wrap; color: #000000; font-style: normal; font-variant-ligatures: normal; font-variant-caps: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: start; text-indent: 0px; text-transform: none; widows: 2; word-spacing: 0px; -webkit-text-stroke-width: 0px; text-decoration-thickness: initial; text-decoration-style: initial; text-decoration-color: initial;">--
Anton Tkacik
Software Developer
evolveum.com
</pre><br></div></div><br></div></div></body></html>