GitHub Advisoryadvisory · Packagist

GHSA-g48f-pgwh-wwxx onelogin/php-saml signature wrapping attacks

MEDIUM Published 2024-05-17 Modified 2024-05-17 Official page ↗

Aliases: CVE-2016-1000253
Ecosystem: Packagist
Packages: onelogin/php-saml
Severity: Moderate
Reviewed: 2024-05-17

Affected packages

• Packagist onelogin/php-saml: < 2.10.0 → fixed in 2.10.0

Description

Vulnerability in onelogin/php-saml versions prior to 2.10.0 allows signature Wrapping attacks which may result in a malicious user gaining unauthorized access to a system.

Alias · not in database (1)

CVE-2016-1000253

References

https://github.com/onelogin/php-saml/commit/9d31baa97a57b0989020f62d24307c29e325dac3 web
https://github.com/FriendsOfPHP/security-advisories/blob/master/onelogin/php-saml/CVE-2016-1000253.yaml web
https://github.com/SAML-Toolkits/php-saml package

GHSA-g48f-pgwh-wwxx onelogin/php-saml signature wrapping attacks

Affected packages

Description

Related

Alias · not in database (1)

References