ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
概要
ruby-saml vulnerable to Remote Denial of Service (DoS) with compressed SAML responses
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
ruby-saml provides security assertion markup language (SAML) single sign-on (SSO) for Ruby. Prior to versions 1.12.4 and 1.18.0, ruby-saml is susceptible to remote Denial of Service (DoS) with compressed SAML responses. ruby-saml uses zlib to decompress SAML responses in case they're compressed. It is possible to bypass the message size check with a compressed assertion since the message size is checked before inflation and not after. This issue may lead to remote Denial of Service (DoS). Versions 1.12.4 and 1.18.0 fix the issue.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
影響パッケージ
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2025-25293 ruby-saml 修正版: 1.11.0-1+deb11u2
参照URL
- advisory github.blog
- advisory github.com
- advisory github.com
- advisory security.netapp.com
- advisory securitylab.github.com
- patch about.gitlab.com
- patch github.com
- patch github.com
- web github.com
- web github.com
- web nvd.nist.gov
- web lists.debian.org