Skip to content
OpenAdvisories
High DSA-4560-1 1 CVE

simplesamlphp - security update

Published Nov 6, 2019 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 2

ReleasePackageFixed in
Debian · 10 simplesamlphp 1.16.3-1+deb10u1
Debian · 9 simplesamlphp 1.14.11-1+deb9u2

Vulnerabilities 1

  • High 8.8
    CVE-2019-3465

    Signature validation bypass in XmlSecLibs

    Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating…

    simplesamlphp simplesamlphp robrichards/xmlseclibs Debian Ubuntu Packagist