omniauth-saml vulnerable to Improper Verification of Cryptographic Signature

2024-09-1121:08:26

Google

osv.dev

omniauth-saml

improper verification

cryptographic signature

vulnerable

new release

patched versions

ruby-saml

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

AI Score

6.7

Confidence

Low

ruby-saml, the dependent SAML gem of omniauth-saml has a signature wrapping vulnerability in <= v1.12.0 and v1.13.0 to v1.16.0 , see https://github.com/SAML-Toolkits/ruby-saml/security/advisories/GHSA-jw9c-mfg7-9rx2
As a result, omniauth-saml created a new release by upgrading ruby-saml to the patched versions v1.17.