ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Summary
ruby-saml vulnerable to SAML authentication bypass due to DOCTYPE handling (parser differential)
Original description
The description as published by the source.
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. An authentication bypass vulnerability was found in ruby-saml prior to versions 1.12.4 and 1.18.0 due to a parser differential. ReXML and Nokogiri parse XML differently; the parsers can generate entirely different document structures from the same XML input. That allows an attacker to be able to execute a Signature Wrapping attack. This issue may lead to authentication bypass. Versions 1.12.4 and 1.18.0 fix the issue.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Affected packages
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2025-25291 ruby-saml Fixed in: 1.11.0-1+deb11u2
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory securitylab.github.com
- advisory github.com
- patch github.com
- patch github.com
- web about.gitlab.com
- web github.blog
- web github.com
- web github.com
- web news.ycombinator.com
- web portswigger.net
- web lists.debian.org