CVE-2019-3465

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2019-3465
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3465.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2019-3465
Aliases
Downstream
Published
2019-11-07T20:15:11.090Z
Modified
2026-07-08T05:55:32.218655486Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Database specific 
{
    "unresolved_ranges": [
        {
            "source": "CPE_STRING",
            "cpes": [
                "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*"
            ],
            "vendor_product": "debian:debian_linux",
            "extracted_events": [
                {
                    "introduced": "8.0"
                },
                {
                    "last_affected": "8.0"
                },
                {
                    "introduced": "9.0"
                },
                {
                    "last_affected": "9.0"
                },
                {
                    "introduced": "10.0"
                },
                {
                    "last_affected": "10.0"
                }
            ]
        }
    ]
}
References

Affected packages

Git / github.com/robrichards/xmlseclibs

Affected ranges

Type
GIT
Repo
https://github.com/robrichards/xmlseclibs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
79fb5e03c4ee4dc3ec77e4b2628231374364a017
Introduced
1b78df099c107279e9069a7b7608be98fd530dfd
Last affected
eadb8f66d9fb3507d165e3ff1fbbe1b7bf153209
Introduced
a29eb3100eb6c5a427d6a3f9e61aff37492405ae
Last affected
406c68ac9124db033d079284b719958b829cb830
Fixed
0a53d3c3aa87564910cae4ed01416441d3ae0db5
Database specific 
{
    "cpe": "cpe:2.3:a:xmlseclibs_project:xmlseclibs:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "1.0.0"
        },
        {
            "last_affected": "1.4.2"
        },
        {
            "introduced": "2.0.0"
        },
        {
            "last_affected": "2.1.0"
        },
        {
            "introduced": "3.0.0"
        },
        {
            "last_affected": "3.0.3"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.3.2
1.4.0
1.4.1
1.4.2
2.*
2.0.0
2.0.1
2.1.0
3.*
3.0.0
3.0.1
3.0.2
3.0.3

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3465.json"

Git / github.com/simplesamlphp/simplesamlphp

Affected ranges

Type
GIT
Repo
https://github.com/simplesamlphp/simplesamlphp
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
381bb09e98267c406386df747378564fef499a94
Database specific 
{
    "cpe": "cpe:2.3:a:simplesamlphp:simplesamlphp:*:*:*:*:*:*:*:*",
    "source": "CPE_RANGE",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "1.17.6"
        }
    ]
}

Affected versions

v1.*
v1.12.0
v1.15.0-rc1
v1.17.0
v1.17.0-rc1
v1.17.0-rc2
v1.17.0-rc3
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-3465.json"