[SECURITY] [DLA 4115-1] ruby-saml security update

Debian LTS Advisory DLA-4115-1 [email protected] https://www.debian.org/lts/security/ Daniel Leidert April 05, 2025 https://wiki.debian.org/LTS Package : ruby-saml Version : 1.11.0-1+deb11u2 CVE ID : CVE-2025-25291 CVE-2025-25292 CVE-2025-25293 Debian Bug : 1100441 Multiple...

Debian dla-4115 : ruby-saml - security update

The remote Debian 11 host has a package installed that is affected by multiple vulnerabilities as referenced in the dla-4115 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4115-1 [email protected]...

Ubuntu: Security Advisory (USN-7409-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-7409-1 ruby-saml vulnerabilities

It was discovered that ruby-saml did not correctly handle XML parsing. An attacker could possibly use this issue to perform a signature wrapping attack and bypass authentication. CVE-2025-25291 and CVE-2025-25292 It was discovered that ruby-saml did not correctly handle decompressing SAML...

com.joelj.jenkins:ez-templates (1.0.5), org.jenkins-ci.main:jenkins-test-harness (1.574) +6 more potentially affected by CVE-2025-31721 via org.jenkins-ci.main:jenkins-core (1.574)

org.jenkins-ci.main:jenkins-core MAVEN version 1.574 is affected by a known vulnerability. The following packages have a transitive dependency on org.jenkins-ci.main:jenkins-core and may be impacted: - com.joelj.jenkins:ez-templates 1.0.5 - org.jenkins-ci.main:jenkins-test-harness 1.574 -...

Shibboleth < 3.5.0.1 Forged Messages

The version of Shibboleth Service Provider installed on the remote is prior to 3.5.0.1. It is, therefore, affected by a vulnerability. The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

SAML SSO Library DoS

The vulnerability of the SAML SSO library in Ruby SAML relates to an uncontrolled resource consumption. Exploiting this vulnerability could allow a malicious actor to cause a service failure...

CVE-2025-29033

An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...

PT-2025-14388 · Bamboohr · Bamboohr

Name of the Vulnerable Software and Affected Versions: BambooHR Build version 25.0210.170831-83b08dd Description: The issue allows a remote attacker to escalate privileges via the /saml/index.php?r= HTTP GET parameter. This parameter is vulnerable to exploitation, enabling an attacker to gain...

CVE-2025-29033: Improper Privilege Management

An issue in BambooHR Build v.25.0210.170831-83b08dd allows a remote attacker to escalate privileges via the /saml/index.php?r=" HTTP GET parameter...

CVE-2025-31335

A flaw was found in the OpenSAML C++ library. This vulnerability allows forging signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures. Mitigation Mitigation for this issue is either not available or the currently available options do not meet the...

DEBIAN-CVE-2025-31335

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

CVE-2025-31335

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

CVE-2025-31335

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

CVE-2025-31335

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

CVE-2025-31335

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

CVE-2025-31335

CVE-2025-31335 affects the OpenSAML C++ library prior to 3.3.1, where parameter manipulation can forge signed SAML messages for bindings that rely on non-XML signatures. The issue is confirmed in multiple feeds referencing OpenSAML

CVE-2025-31335

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

CVE-2025-31335: Improper Verification of Cryptographic Signature

The OpenSAML C++ library before 3.3.1 allows forging of signed SAML messages via parameter manipulation when using SAML bindings that rely on non-XML signatures...

[SECURITY] [DLA 4093-1] opensaml security update

Debian LTS Advisory DLA-4093-1 [email protected] https://www.debian.org/lts/security/ Andreas Henriksson March 27, 2025 https://wiki.debian.org/LTS Package : opensaml Version : 3.2.0-2+deb11u1 CVE ID : TEMP-1100464-F28DDC Debian Bug : 1100464 Alexander Tan discovered that the OpenSAML C...