Medium CVE-2016-1000253 GHSA-g48f-pgwh-wwxx

onelogin/php-saml signature wrapping attacks

Published May 17, 2024 · Updated Dec 2, 2024 · Assigned by GHSA

Package: onelogin/php-saml Ecosystem: Packagist

Description

Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Packagist	onelogin/php-saml	< 2.10.0	2.10.0	GHSA-g48f-pgwh-wwxx

References

https://github.com/onelogin/php-saml/commit/9d31baa97a57b0989020f62d24307c29e325dac3 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/onelogin/php-saml/CVE-2016-1000253.yaml web
https://github.com/SAML-Toolkits/php-saml package