Skip to content
OpenAdvisories
Critical USN-7309-1 3 CVEs

Ruby SAML vulnerabilities

Published Feb 28, 2025 · Updated Jun 25, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Ruby SAML did not properly validate SAML responses.
An unauthenticated attacker could use this vulnerability to log in as an
abitrary user. This issue only affected Ubuntu 16.04 LTS. (CVE-2016-5697)

It was discovered that Ruby SAML incorrectly utilized the results of XML
DOM traversal and canonicalization APIs. An unauthenticated attacker could
use this vulnerability to log in as an abitrary user. This issue only
affected Ubuntu 16.04 LTS. (CVE-2017-11428)

It was discovered that Ruby SAML did not properly verify the signature of
the SAML Response, allowing multiple elements with the same ID. An
unauthenticated attacker could use this vulnerability to log in as an
abitrary user. (CVE-2024-45409)

Fixed packages 5

ReleasePackageFixed in
Ubuntu · 20.04 LTS 20.04:LTS ruby-saml 1.11.0-1ubuntu0.1
Ubuntu · 22.04 LTS 22.04:LTS ruby-saml 1.13.0-1ubuntu0.1
Ubuntu · 24.04 LTS 24.04:LTS ruby-saml 1.15.0-1ubuntu0.24.04.1
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS ruby-saml 1.1.2-1ubuntu1+esm1
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS ruby-saml 1.7.2-1ubuntu0.1~esm1

Vulnerabilities 3

  • Critical 10.0
    CVE-2024-45409 Public exploit EPSS 12%

    The Ruby SAML library vulnerable to a SAML authentication bypass via Incorrect XPath selector

    The Ruby SAML library is for implementing the client side of a SAML authorization. Ruby-SAML in <= 12.2 and 1.13.0 <= 1.16.0 does not properly verify the signature of the SAML Response. An unauthenticated attacker with access to any signed saml document (by t…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • High 7.7
    CVE-2017-11428

    Multiple SAML libraries may allow authentication bypass via incorrect XML canonicalization and DOM traversal

    OneLogin Ruby-SAML 1.6.0 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attac…

    OneLogin Ruby-SAML ruby-saml ruby-saml Debian Ubuntu RubyGems
  • High 7.5
    CVE-2016-5697

    Ruby-saml allows attackers to perform XML signature wrapping attacks

    Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.

    ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems

References

  • report
    https://ubuntu.com/security/CVE-2016-5697
  • report
    https://ubuntu.com/security/CVE-2017-11428
  • report
    https://ubuntu.com/security/CVE-2024-45409