Skip to content
OpenAdvisories
Critical DLA-3949-1 1 CVE

ruby-saml - security update

Published Nov 11, 2024 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 ruby-saml 1.11.0-1+deb11u1

Vulnerabilities 1

  • Critical 10.0
    CVE-2024-45409 Public exploit EPSS 12%

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by t…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems