Summary
It was discovered that ruby-saml did not correctly handle XML parsing.
An attacker could possibly use this issue to perform a signature
wrapping attack and bypass authentication. (CVE-2025-25291
and CVE-2025-25292)
It was discovered that ruby-saml did not correctly handle decompressing
SAML responses. An attacker could possibly use this issue to cause
a denial of service. (CVE-2025-25293)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | ruby-saml | 1.1.2-1ubuntu1+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | ruby-saml | 1.7.2-1ubuntu0.1~esm2 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | ruby-saml | 1.11.0-1ubuntu0.1+esm1 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | ruby-saml | 1.13.0-1ubuntu0.1+esm1 |
| Ubuntu · Pro 24.04 LTS Pro:24.04:LTS | ruby-saml | 1.15.0-1ubuntu0.24.04.1+esm1 |
Vulnerabilities 3
-
Critical 9.3CVE-2025-25291 EPSS 21%
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…
-
Critical 9.3CVE-2025-25292 EPSS 65%
Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…
-
High 7.7
ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML …