~ / search / GHSA-pqm6-cgwr-x6pf

GHSA-pqm6-cgwr-x6pf

Signature validation bypass in XmlSecLibs

Source: GitHub Advisory Database (reviewed) High CVE-2019-3465

Packages

EcosystemPackageAffectedFixed in
Packagist robrichards/xmlseclibs >= 3.0.0, < 3.0.4 3.0.4
Packagist robrichards/xmlseclibs >= 1.0.0, < 2.1.1 2.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

References

External links from the advisory. They lead to third-party sites.