CVE-2024-52806
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
Summary
SimpleSAMLphp SAML2 has an XXE in parsing SAML messages
Original description
The description as published by the source.
SimpleSAMLphp SAML2 library is a PHP library for SAML2 related functionality. When loading an (untrusted) XML document, for example the SAMLResponse, it's possible to induce an XXE. This vulnerability is fixed in 4.6.14 and 5.0.0-alpha.18.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2024-52806 simplesamlphp Fixed in: 1.19.0-1+deb11u1
- Ubuntu UBUNTU-CVE-2024-52806 simplesamlphp
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com