Skip to content
OpenAdvisories
High WID-SEC-2025-0561 3 CVEs

Ruby SAML: Mehrere Schwachstellen

Published Mar 13, 2025 · Updated Apr 6, 2025 · Revision 3 · de-DE

Vendor: Debian Vendor: HashiCorp Vendor: NETAPP Vendor: Ubuntu Product: Linux Product: Linux Product: StorageGRID Product: Terraform Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby SAML ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Denial of Service Zustand herbeizuführen.

Product

RubySAML ist eine Authentifizierungsbibliothek.

Vulnerabilities 3

  • Critical 9.3
    CVE-2025-25291 EPSS 21%

    ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • Critical 9.3
    CVE-2025-25292 EPSS 65%

    Ruby SAML vulnerable to SAML authentication bypass due to namespace handling (parser differential)

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differentl…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems
  • High 7.7
    CVE-2025-25293

    ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses

    ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML …

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Debian Ubuntu RubyGems

Revision history

  1. #3

    Neue Updates von Debian aufgenommen

  2. #2

    Neue Updates von Ubuntu aufgenommen

  3. #1

    Initiale Fassung

References