GHSA-cvp8-5r8g-fhvq

Suggest an improvement
Source
https://github.com/advisories/GHSA-cvp8-5r8g-fhvq
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/09/GHSA-cvp8-5r8g-fhvq/GHSA-cvp8-5r8g-fhvq.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cvp8-5r8g-fhvq
Aliases
Related
Published
2024-09-11T21:08:26Z
Modified
2024-09-21T08:12:06.074331Z
Severity
  • 10.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N CVSS Calculator
  • 9.9 (Critical) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N CVSS Calculator
Summary
omniauth-saml vulnerable to Improper Verification of Cryptographic Signature
Details

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2 As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.

References

Affected packages

RubyGems / omniauth-saml

Package

Name
omniauth-saml
Purl
pkg:gem/omniauth-saml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.0.0
Fixed
2.1.2

Affected versions

2.*

2.0.0
2.1.0
2.1.1

RubyGems / omniauth-saml

Package

Name
omniauth-saml
Purl
pkg:gem/omniauth-saml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.10.5

Affected versions

0.*

0.9.0
0.9.1
0.9.2

1.*

1.0.0
1.1.0
1.2.0
1.3.0
1.3.1
1.4.0
1.4.1
1.4.2
1.5.0
1.6.0
1.7.0
1.8.0
1.8.1
1.9.0
1.10.0
1.10.1
1.10.2
1.10.3
1.10.4

RubyGems / omniauth-saml

Package

Name
omniauth-saml
Purl
pkg:gem/omniauth-saml

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.2.0
Fixed
2.2.1

Affected versions

2.*

2.2.0