Skip to content
OpenAdvisories
High · 8.8 CVE-2019-3465 EUVD-2019-0760GHSA-pqm6-cgwr-x6pf

Signature validation bypass in XmlSecLibs

Published Nov 7, 2019 · Updated Aug 4, 2024 · Assigned by debian

Package: robrichards/xmlseclibs Package: simplesamlphp Package: simplesamlphp Ecosystem: Debian Ecosystem: Packagist Ecosystem: Ubuntu

Description

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Affected products

VendorProductAffectedFixed
— Rob Richards XmlSecLibs All versions prior to version 3.0.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 simplesamlphp 1.17.6-2 —
Debian 12 simplesamlphp 1.17.6-2 —
Debian 10 simplesamlphp 1.16.3-1+deb10u1 DSA-4560-1
Debian 9 simplesamlphp 1.14.11-1+deb9u2 DSA-4560-1
Debian 8 simplesamlphp 1.13.1-2+deb8u3 DLA-1983-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS simplesamlphp 1.19.7-1+deb12u1ubuntu0.1 USN-8770-1
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS simplesamlphp 1.19.1-1.1ubuntu0.1~esm1 USN-8770-1
Ubuntu Pro 20.04 LTS simplesamlphp 1.18.4-1ubuntu0.1~esm1 USN-8770-1
Ubuntu Pro 18.04 LTS simplesamlphp 1.15.3-1ubuntu0.1~esm1 USN-8770-1
Ubuntu Pro 16.04 LTS simplesamlphp 1.14.0-1ubuntu2+esm1 USN-8770-1

Affected packages

EcosystemPackageAffectedFixedRecord
Packagist robrichards/xmlseclibs >= 3.0.0, < 3.0.4 3.0.4 GHSA-pqm6-cgwr-x6pf
Packagist robrichards/xmlseclibs >= 1.0.0, < 2.1.1 2.1.1 GHSA-pqm6-cgwr-x6pf

Advisories 3

References