CVE-2017-12873

SimpleSAMLphp 1.7.0 through 1.14.10 might allow attackers to obtain sensitive information, gain unauthorized access, or have unspecified other impacts by leveraging incorrect persistent NameID generation when an Identity Provider (IdP) is misconfigured.

References

Affected packages

Git / github.com/cesnet/proxystatistics-simplesamlphp-module

Affected ranges

Type

GIT

Repo

https://github.com/cesnet/proxystatistics-simplesamlphp-module

Events

Introduced

Last affected

454bbead35b50c99470cc68aa139fb9b73c22b2a

Introduced

Last affected

e28d4acff4dd8f1aa8d07dfe86a5f02f9db764f4

Database specific

{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "7.0"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "8.0"
        }
    ]
}

Type

GIT

Repo

https://github.com/simplesamlphp/simplesamlphp

Events

Introduced

30dc769de1486b6658891b9a4847587f14be3d53

Last affected

da637c53962c13905eaae5ec9f33e658a237c284

Fixed

90dca835158495b173808273e7df127303b8b953

Database specific

{
    "versions": [
        {
            "introduced": "1.7.0"
        },
        {
            "last_affected": "1.14.10"
        }
    ]
}

Affected versions

v4.*

v4.3.0

v5.*

v5.0.0

v6.*

v6.0.0

v7.*

v7.0.0

Database specific

unresolved_ranges

[
    {
        "events": [
            {
                "introduced": "0"
            },
            {
                "last_affected": "9.0"
            }
        ]
    }
]

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2017-12873.json"