CVE-2024-47832

See a problem?
Please try reporting it to the source first.
Source
https://nvd.nist.gov/vuln/detail/CVE-2024-47832
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47832.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-47832
Aliases
Downstream
Related
Published
2024-10-09T18:32:19Z
Modified
2025-10-14T14:34:56Z
Severity
  • 9.3 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
XML Signature Bypass via differential XML parsing in ssoready
Details

ssoready is a single sign on provider implemented via docker. Affected versions are vulnerable to XML signature bypass attacks. An attacker can carry out signature bypass if you have access to certain IDP-signed messages. The underlying mechanism exploits differential behavior between XML parsers. Users of https://ssoready.com, the public hosted instance of SSOReady, are unaffected. We advise folks who self-host SSOReady to upgrade to 7f92a06 or later. Do so by updating your SSOReady Docker images from sha-... to sha-7f92a06. There are no known workarounds for this vulnerability.

References

Affected packages

Git /

Affected ranges

Database specific 

{
    "unresolved_versions": [
        {
            "events": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "0.0.0-20241009153838-7f92a0630439"
                }
            ],
            "type": ""
        }
    ]
}

Git /

Affected ranges

Database specific 

{
    "unresolved_versions": [
        {
            "events": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "7f92a06"
                }
            ],
            "type": ""
        }
    ]
}