SimpleSAMLphp InfoCard module Incorrect signature verification

HIGH 7.5CVE-2017-12874 · GHSA-fj28-869x-vv5g · Published 01/09/2017 · updated 17/06/2026

In short

CVE-2017-12874 is a HIGH (CVSS 7.5) vulnerability affecting simplesamlphp/simplesamlphp-module-infocard, infocard module (simplesamlphp).
Chance of exploitation in the next 30 days (EPSS): 1.3%, higher than 69.9% of all vulnerabilities.
Fix: update to 1.0.1 or later.

Package	Affected versions	Patched versions
simplesamlphp/simplesamlphp-module-infocard Packagist	`< 1.0.1`	`1.0.1`
infocard module simplesamlphp	`= 1.0`	No fix yet

Description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

NVD description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

References

nvd.nist.gov/vuln/detail/CVE-2017-12874 · ADVISORY
simplesamlphp/simplesamlphp-module-infocard commit 63b84cc · WEB
FriendsOfPHP/security-advisories · WEB
simplesamlphp/simplesamlphp · PACKAGE
lists.debian.org/debian-lts-announce/2017/12/msg00007.html · WEB
simplesamlphp.org/security/201612-03 · WEB
debian.org/security/2018/dsa-4127 · WEB

More vulnerabilities in simplesamlphp/simplesamlphp-module-infocard

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

simplesamlphp/simplesamlphp-module-infocard

Packagist

< 1.0.1

1.0.1

infocard module

simplesamlphp

= 1.0

No fix yet

Description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

NVD description

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.