ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Résumé
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Description d'origine
La description telle que publiée par la source (souvent en anglais).
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Paquets affectés
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2025-25291 ruby-saml Corrigé dans: 1.11.0-1+deb11u2
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory securitylab.github.com
- advisory github.com
- patch github.com
- patch github.com
- web about.gitlab.com
- web github.blog
- web github.com
- web github.com
- web news.ycombinator.com
- web portswigger.net
- web lists.debian.org