CVE-2016-5697 — Ruby-saml allows attackers to perform XML signature wrapping attacks

Description

Ruby-saml before 1.3.0 allows attackers to perform XML signature wrapping attacks via unspecified vectors.

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	ruby-saml	1.3.0-1	—

Ubuntu

Security tracker ↗

Release	Package	Fixed in	Advisory
Ubuntu 24.04 LTS	ruby-saml	1.15.0-1ubuntu0.24.04.1	USN-7309-1
Ubuntu 22.04 LTS	ruby-saml	1.13.0-1ubuntu0.1	USN-7309-1
Ubuntu 20.04 LTS	ruby-saml	1.11.0-1ubuntu0.1	USN-7309-1

Show 2 more (older releases, extended support, other products)

Release	Package	Fixed in	Advisory
Ubuntu Pro 18.04 LTS	ruby-saml	1.7.2-1ubuntu0.1~esm1	USN-7309-1
Ubuntu Pro 16.04 LTS	ruby-saml	1.1.2-1ubuntu1+esm1	USN-7309-1

Affected packages

Ecosystem	Package	Affected	Fixed	Record
RubyGems	ruby-saml	< 1.3.0	1.3.0	GHSA-36p7-xjw8-h6f2

Advisories 1

USN-7309-1 Ruby SAML vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026

References

[oss-security] 20160624 [CVE-2016-5697] signature wrapping attack vulnerability in ruby-saml prior to version 1.3.0 http://www.openwall.com/lists/oss-security/2016/06/24/3 MLIST:[oss-security] 06/24/2016 Re: [CVE-2016-5697] signature wrapping attack mailing-list