Skip to content
OpenAdvisories
High WID-SEC-2025-2764 2 CVEs

Ruby SAML: Mehrere Schwachstellen ermöglichen Umgehen von Sicherheitsvorkehrungen

Published Dec 8, 2025 · Updated Jan 25, 2026 · Revision 2 · de-DE

Vendor: NETAPP Product: StorageGRID Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby SAML ausnutzen, um Sicherheitsvorkehrungen zu umgehen.

Product

Ruby ist eine interpretierte, objektorientierte Skriptsprache.

Vulnerabilities 2

  • Critical 9.3
    CVE-2025-66567

    ruby-saml has a SAML authentication bypass due to namespace handling (parser differential)

    The ruby-saml library is for implementing the client side of a SAML authorization. ruby-saml versions up to and including 1.12.4 contain an authentication bypass vulnerability due to an incomplete fix for CVE-2025-25292. ReXML and Nokogiri parse XML different…

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Ubuntu RubyGems
  • Critical 9.3
    CVE-2025-66568

    ruby-saml Libxml2 Canonicalization errors can bypass Digest/Signature validation

    The ruby-saml library implements the client side of an SAML authorization. Versions up to and including 1.12.4, are vulnerable to authentication bypass through the libxml2 canonicalization process used by Nokogiri for document transformation, which allows an …

    SAML-Toolkits ruby-saml ruby-saml ruby-saml Ubuntu RubyGems

Revision history

  1. #2

    Neue Updates von NetApp aufgenommen

  2. #1

    Initiale Fassung

References