GitHub Advisoryadvisory · Packagist

GHSA-pqm6-cgwr-x6pf Signature validation bypass in XmlSecLibs

HIGH Published 2019-11-08 Modified 2021-08-18 Official page ↗
Aliases
CVE-2019-3465
Ecosystem
Packagist
Packages
robrichards/xmlseclibs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-347
Reviewed
2019-11-08

Affected packages

• Packagist robrichards/xmlseclibs: >= 3.0.0, < 3.0.4 → fixed in 3.0.4 • Packagist robrichards/xmlseclibs: >= 1.0.0, < 2.1.1 → fixed in 2.1.1

Description

Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of cryptographic signatures in XML messages, allowing an authenticated attacker to impersonate others or elevate privileges by creating a crafted XML message.

Related

Alias · CVE (1)

  • CVE-2019-3465 Rob Richards XmlSecLibs, all versions prior to v3.0.3, as used for example by SimpleSAMLphp, performed incorrect validation of… vulnerability

Weakness · CWE (1)

  • CWE-347 Improper Verification of Cryptographic Signature weakness

References