GHSA-qv5p-6wrc-79wg
SimpleSAMLphp Use of insecure connection charset (sqlauth module)
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | simplesamlphp/simplesamlphp | < 1.15.2 | 1.15.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
The sqlauth module in SimpleSAMLphp before 1.15.2 relies on the MySQL utf8 charset, which truncates queries upon encountering four-byte characters. There might be a scenario in which this allows remote attackers to bypass intended access restrictions.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2018-6521
- https://github.com/FriendsOfPHP/security-advisories/blob/master/simplesamlphp/simplesamlphp/CVE-2018-6521.yaml
- https://github.com/simplesamlphp/simplesamlphp
- https://lists.debian.org/debian-lts-announce/2018/02/msg00008.html
- https://simplesamlphp.org/security/201801-03
- https://www.debian.org/security/2018/dsa-4127